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FOREWORD 



Intelligence — vital information about persons and phenomena that 
would do us harm — has been used to great effect by the Law Enforcement 
community for many years to support operations and ensure public safety. 
Human source development tradecraft, technical collection techniques, 
analytic methodologies and tools, and information sharing policies and 
systems have been a mainstay of law enforcement operations for many 
years. Globalization and the decline of the nation state have given rise to 
new adversaries, many of which resemble shadowy criminal-like networks 
that use technology to operate across national boundaries and threaten both 
national security and public safety. Can’t We All Just Get Along? Improving 
the Law Enforcement-Intelligence Community Relationship is a powerful 
and thoughtful compendium that explores law enforcement intelligence 
techniques and their utility for the National Intelligence Community, as 
well as proven Intelligence Community methodologies and their potential 
application for law enforcement intelligence operations. Most importantly, 
the compendium eloquently reminds us that it is the “soft stuff’ — culture, 
training, trust — that presents the greatest challenge to achieving a partnership 
between Law Enforcement and the Intelligence Community that the threat 
demands and our citizens deserve. 

Much has been said about Law Enforcement not “getting” intelligence and 
about the Intelligence Community not “getting” law enforcement operations. 
Those of us who have had the privilege of serving in both communities know 
from experience that neither assertion is true and have urged a thoughtful 
analysis of facts to tamp down the emotion that surrounds this debate. 
This work succeeds in moving us beyond surface judgments and emotions, 
exploring law enforcement intelligence tools and techniques in some depth 
and pointing to their utility in fighting and prevailing over today’s adversaries. 
Just as importantly, it points to extant Intelligence Community practices 
that if applied broadly will help Law Enforcement make the transition from 
prosecution to prevention. 

There has always been a rather healthy tension between the producers 
of intelligence and the users of intelligence. Can’t We All Just Get Along? 
reminds us that intelligence operations are not conducted for their own sake, 
but rather to inform the decisions of those who must act in defense of national 
security/public safety. The value of intelligence is in the eyes of its users, not 
its producers; intelligence is at its best when it is fully integrated with its users. 
These simple truths led to the development of intelligence methodologies and 
techniques as a function of support to specific instruments of national power 
such as diplomacy, law enforcement, and war fighting. The nature of today’s 
threats has blurred the lines between traditional diplomatic, military, and law 
enforcement concerns, requiring all instruments of national power to work 
as a seamless network to defeat our adversaries. The rise of joint task forces, 
intelligence operations centers, and fusion centers has brought together 



professionals from across the law enforcement, military, and intelligence 
communities, offering them a unique opportunity to share tools and techniques 
in defense of the nation. Can’t We All Just Get Along? provides an important 
foundation for understanding the strengths that each community brings to the 
joint environment and is a must read for all intelligence professionals. 



Maureen Baginski 

Former FBI Executive Assistant Director 
Intelligence 

Former NSA Signals Intelligence Director 
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COMMENTARY 



In the five years since 9/11, Law Enforcement has been re-inventing itself, 
and intelligence agencies have been making changes that run contrary to 
years of established policy, tradecraft, and procedure. However, old habits 
die hard and many traditional structures remain firmly in place. Whether the 
ongoing efforts at restructuring are actually effecting change or are mostly 
window dressing remains an open question. 

We face an enemy who plans operations strategically and exploits our 
vulnerabilities creatively. This enemy functions in a manner our institutions 
are not designed to address. To win, it is imperative that we fight more 
creatively and strategically than our adversaries. That means taking full 
advantage of ALL the resources at our disposal and wielding them as 
effectively as possible. 

As a criminal investigator for the past 20 years and as chief of a transnational 
criminal investigative section, 1 have seen the best and the worst of the 
relationship between the law enforcement and intelligence communities. 1 
have witnessed how acrimonious that relationship can be; to be honest, I’ve 
contributed to the problem myself. But when the relationship works, it works 
very well. These two distinct communities can cooperate to great effect 
without violating privacy rights or precluding criminal prosecution. There is 
plenty of common ground that is overt, legal, and proper. 

A few years ago, I investigated an anonymous letter that warned there was 
a visa fraud operation targeting a U.S. consulate in a large Muslim country. 
The letter alleged that the operation was being run out of an unnamed textile 
company that was facilitating A1 Qaeda’s travel by sponsoring several terrorists 
to attend a U.S. trade show. Working with our intelligence agencies, we were 
able to identify the textile company in question. Then my investigators and 
the local police located and interviewed the writer of the letter. Both sides 
contributed their particular expertise and the situation was quickly resolved. 

On other occasions, however, U.S. intelligence gave me information 
about a threat to a U.S. diplomatic mission but prohibited me from acting 
on the information; “sources and methods” and all. I had to appeal to higher 
authorities before I could take necessary precautions — which we did without 
disclosing the sources or methods. 

Out of undue regard for certain concerns, Law Enforcement and the IC 
have repeatedly stymied one another. Law enforcement invokes privacy 
concerns and investigative case secrecy to protect its information. The IC 
invokes “sources and methods” to protect its capabilities. Sure, there are 
good reasons to maintain case control and protect sources; but there are many 
occasions when cooperation can work around these issues. In the past, there 
was less reason to do so. There is more now. 
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Can ’t We All Just Get Along? provides ideas that will help law enforcement 
and the IC realize some strategic advantage from greater mutual awareness. This 
compilation is an ideal vehicle for an ongoing dialogue between intelligence 
and law enforcement. I hope it will serve as a catalyst for discussion at the 
grassroots, operational, and executive levels of both communities. Most of 
us in Law Enforcement are not formally part of the IC, but we produce and 
consume intelligence every day. The ideas that follow can help us do better 
at both. 



Mike Bayer, Branch Chief 
Transnational Criminal Investigations 
Diplomatic Security Service 
U.S. Department of State 
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BEST PRACTICES IN LAW ENFORCEMENT 
AND THE INTELLIGENCE COMMUNITY 

The essays that make up this compendium envision a future with an 
ideal, seamless relationship between and among law enforcement (LE) 
and intelligence agencies. The first essays suggest lessons the Intelligence 
Community (IC) can learn from law enforcement, as well as some IC 
“teaching points. ” In each case, years of experience in LE, the IC, or both 
complement the author’s scholarship. 

These practitioners focus on specific innovations in a particular area 
of intelligence or law enforcement that may have application elsewhere. 
There are no suggestions for overall restructuring of either community, and 
even the mechanisms for introducing a desirable change are not discussed 
in any detail. Whatever the benefits of greater integration at the national 
level, these essays illustrate the value of more transparency among those 
“in the trenches. ” 
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DEVELOPMENTS IN LAW 
ENFORCEMENT INTELLIGENCE ANALYSIS 



Marilyn B. Peterson, MA 

Certified Criminal Analyst, Certified Fraud Examiner 

This article suggests that it would be beneficial for the Intelligence 
Community (IC) and Law Enforcement (LE) to cross-train and collaborate 
in the application of analytic methods. All-source analysis is the norm 
in both law enforcement and the Intelligence Community, although for 
different purposes: investigation and prosecution or warning and prevention. 
The distinctions between the two blur in cases where international actors 
undertake criminal acts (terrorism or narcotics distribution, for instance) or 
where investigative techniques support intelligence as well as police work 
(nuclear proliferation or counterintelligence, for example). 

LAW ENFORCEMENT AND INTELLIGENCE 

Intelligence, in law enforcement, is defined as information that has been 
collected, evaluated, collated, and analyzed, with hypotheses drawn from 
it and potential courses of action noted. This differs from the IC’s view of 
intelligence, which has traditionally emphasized its being secret information. 
Intelligence in law enforcement is drawn from information subpoenaed 
from its owner; received through a judicially-approved search of a person’s 
residence, business, or vehicle; obtained from physical or court-authorized 
electronic surveillance; or found in open records such as deeds, licenses, 
business filings, or trusted media. 

Analysis of materials is needed to achieve the “intelligence” state. Analytic 
methods and techniques have developed from rudimentary to complex in the 
35 years since formal analysis was introduced to law enforcement. Informal 
sharing of techniques between the IC and LE occurs primarily through 
literature and professional organizations. The current shared missions of 
counterterrorism and counter-narcotics work may institutionalize further 
exchanges of methods, techniques, and intelligence. Recent laws that allow 
some sharing of the IC’s “foreign” intelligence and LE’s domestic data 
support these exchanges. 

Early History of LE Intelligence Analysis and Its Relations with 
the IC 

There were intelligence units in larger city departments (like NYPD) in 
the 1930s and 1940s, targeting primarily anarchists and the Cosa Nostra. 
Some members of the “Mafia” migrated to the U.S. in the 1890s and, by 
Prohibition, were firmly established in Chicago, New York, and other major 
cities. In the 1950s, the Congressional Kefauver Commission investigated 
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organized crime and found that it was involved in bookmaking, prostitution, 
and the sale and distribution of narcotics. The Commission named 15 cities, 
from coast to coast, that had organized crime activity and the resultant police 
corruption. 1 State and local law enforcement authorities were aware of their 
problems with organized crime, but the FBI would not share data with them 
at that time, fearing that the locals would give information to the criminals. 
Thus, the Law Enforcement Intelligence Unit (LEIU) was developed in 1956, 
begun by the California Department of Justice and others to improve the 
sharing of organized crime intelligence among state and local law enforcement 
agencies. 2 

The LE focus on traditional organized crime continued through the 1950s 
and 1960s. The police raided the Appalachian meeting in upstate New York of 
the Cosa Nostra family leaders in 1957. Attorney General Robert F. Kennedy 
tried to prosecute organized crime until he left office in 1964. 

The 1967 President’s Organized Crime Commission recognized the need 
for stronger intelligence in law enforcement. In 1970, major state agencies, 
including the California Department of Justice, the Florida Department of 
Law Enforcement, the Arizona Department of Public Safety, and the New 
Jersey State Police, began to hire intelligence analysts. 

Law enforcement intelligence analysis owes its formal beginnings in the 
early 1970s to the IC. The Justice Department’s Law Enforcement Assistance 
Administration contracted with two former IC professionals, E. Drexel 
Godfrey and Don R. Harris, to write The Basic Elements of Intelligence. This 
book and its revised edition (by Mr. Harris and others in 1976) became the 
“bible” of LE intelligence units in the United States. 3 It discussed factors 
from reporting chains and floor plans to analysts’ experience levels and data 
evaluation. It called analysis “the heart of the intelligence process,” without 
which the effort was only a filing function. 4 

As law enforcement analysis capabilities grew in the 1970s and 1980s, 
they were increasingly used in investigations of organized crime and 
narcotics trafficking. Initiatives to identify and detail the structure of the 
major traditional organized crime (Cosa Nostra) syndicates took precedence. 



1 Special Committee to Investigate Organized Crime (Kefauver Commission), Third Interim 
Report (New York: ARCO Publishing Co., 1951). One of the components of defining organized 
crime is the corruption of the criminal justice system. 

2 

LEIU continues today and now allows federal membership. More information can be 
obtained on-line at URL: <www.leiu-homepage.org>. 

3 

The book was out of print by the 1990s. In 2001, Intelligence 2000: Revising the Basic 
Elements , ed. Marilyn B. Peterson and others (Sacramento, CA: LEIU and IALEIA, 2000) took 
its place as the seminal work. It is used as a primary text in training academies, colleges, and 
universities for classes on intelligence and is available on-line at URL: <www.ialeia.org>. A 
dozen intelligence professionals contributed to the text. 

^ E. Drexel Godfrey and Don R. Harris, The Basic Elements of Intelligence (Washington: 
Government Printing Office, 1971), 4. 
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The primary source of analytic training was Anacapa Sciences of Santa 
Barbara, California. 5 Federal, state, and local law enforcement analysts took 
its courses; only in the past decade or two have some agencies developed 
internal training capabilities. 

The first professional association for analysts, the International Association 
of Law Enforcement Intelligence Analysts (IALEIA), was established in 
1980. 6 This organization, begun by members of federal and state LE agencies 
(including ATF, DEA, the California Department of Justice, and the Florida 
Department of Law Enforcement, as well as some Canadian and Australian 
agencies), advanced the use and understanding of law enforcement intelligence 
analysis. By the mid-1980s, it had initiated a newsletter and a professional 
journal. These, combined with an expanding membership, went a long way 
toward sharing analytic methods and techniques. IALEIA also developed an 
awards program that honored analysts, executives, authors, and agencies for 
exceptional intelligence writing and products. 

Some cross-pollination between the IC and law enforcement occurred. 
In 1986, the International Journal of Intelligence and Counterintelligence 
printed “Law Enforcement Intelligence: A New Look.” 7 The article discussed 
the importance of strategic intelligence in law enforcement and gave 
examples of collection plans and models for developing strategic products. 
These were based on models in Intelligence for the 1980s published by Roy 
Godson and his colleagues. A course developed by the author three years 
later on strategic intelligence in law enforcement was given twice, but it 
attracted no further students. Law enforcement was primarily still reactive 
rather than proactive. 8 

There was more evidence of cross-pollination between local law 
enforcement and members of the IC. Many state and local law enforcement 
agencies opened their intelligence training to military intelligence, military 
police’s Criminal Investigation Division, and other federal analysts and 
officers. This was beneficial to all from the standpoint of both current 
assignments and future employment. Personnel leaving the armed services 
or retiring from federal employment found second careers in state or local 
law enforcement and made the transition more easily for having learned 
law enforcement terminology and methods. When the end of the Cold War 



5 More information on Anacapa Sciences is available on-line at URL: <www.anacapatraining. 
com>. 

^ IALEIA currently has about 1,800 members in over 50 countries. Memberships are 
individual and are held by intelligence officers and analysts in law enforcement, the military, the 

intelligence community, and the corporate sector. 

7 

Marilyn B. Sommers (Peterson), “Law Enforcement Intelligence: A New Look,” 

International Journal of Intelligence and Counterintelligence 1, no. 3 (1986): 25-40. 

8 

The course was resurrected in 1999 and given for state and federal agencies over the ensuing 
three years. Following 9/11, it was re-designed to focus on counterterrorism. 
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reduced the size of the armed services, law enforcement snapped up people 
trained in a variety of specialties, including military intelligence. 

The priority of the late 1980s in many LE agencies was the rapidly 
expanding sale and use of narcotics by the public. In a notable cooperative 
effort that continues today, the National Guard assisted state and local agencies 
in their counter-drug efforts. Creating regional agencies for communication, 
cooperation, and coordination, the federal government provided assistance 
to state and local law enforcement. These included the Regional Information 
Sharing System (RISS) projects (primarily begun around 1980) and the High 
Intensity Drug Trafficking Area (HIDTA) projects (begun around 1990). 
Both these efforts brought together federal, state, and local law enforcement 
to attack criminal syndicates in particular areas. The RISS involved multiple 
states, whereas the HIDTAs covered metropolitan areas or specific borders, 
such as the southwestern U.S. border. 9 

The 1990s 

The role of intelligence expanded in the 1990s to support the investigation 
and prosecution of white-collar crime, internal affairs, street crime, 
counterterrorism, and money laundering. Intelligence was not limited to an 
intelligence unit. Most information gathered in an investigation benefits from 
analytic formats and techniques. Increasing technological sophistication gave 
criminals more tools to evade detection but also provided similar tools to 
law enforcement. The traditional “3 by 5 card” method of sorting data, used 
into the 1980s, gave way to specialized databases that supported various 
information protocols. Computers became commonplace on the desktops of 
analysts and investigators. 



Professional associations created standards for analysts. A certification 
body founded in 1990, the Society of Certified Criminal Analysts (SCCA), 
established educational, training, testing, and experiential standards for 
criminal analysts. 10 It provides both three-year and lifetime certification and 
has certified analysts in several countries. 

Toward the end of the 1990s, more proactive targeting was done on 
investigative subjects by text-mining large databases. One example was the 
use in New Jersey, Massachusetts, and other states of data held by the Treasury 
Department’s Financial Crimes Enforcement Network (FinCEN). These data 
allowed analysts to identify and track large sums of money moving through 
banks, casinos, and non-bank financial institutions (check cashers and wire 



9 

More information on the RISS projects can be found on-line at URL: <www.iir.com/riss>; 
and information on the HIDTAs is available at URL: <www.whitehousedrugpolicy.gov/hidta/ 
index. html>. 

“Purpose,” The Society of Certified Criminal Analysts, URL: <www.certifiedanalysts.net>, 
accessed 1 November 2006. 
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1 . Collect the material and mark it for reliability of the source 
and validity of the data. 

2. Number each page or use its pre-numbering for tracking. 

3. Organize the case information. 

4. Extract the association material. 

5. Place the data into an association database. 

6. Prepare an association matrix. 

7. Count the associations of each person or entity. 

8. Create a diagram based on the association matrix or 
database. 

9. Complete background research on entities to fill in 
knowledge gaps. 

10. Produce biographic summaries of each entity on the chart. 

1 1 . Review the relationships shown for density, between- 
ness, closeness, information bottlenecks, degree of 
centralization, peripheral players, and so forth. 

12. Ask critical questions of the data in the chart. 

13. Summarize the chart. 

14. Establish what necessary information is present and what is 
absent. 

15. Draw interim hypotheses and analyze them for the best 
hypothesis. 

16. Make recommendations for further actions. 

17. Present findings and written report to management. 



Figure 1. Link Analysis Process 

Source: Marilyn B. Peterson, “Association Analysis,” 
unpublished research paper, September 2006. 

remitters). That allowed investigators to trace the funds back to their illegal 
sources. These sources often involved fraud of some kind, from large-scale 
investment fraud to fraudulent documents. This data mining is frequently done 
in the insurance industry, where “flagging” systems identify care providers or 
end users with unusual patterns of claims, ailments, or treatments, allowing 
investigators to identify insurance fraud rings and repeat offenders. 

Another shift in LE analysis in the 1990s was distinguishing between 
analytic products and the analytic process. In earlier days, people focused on 
the charts and visual products of analysis rather than on the meaning of the 
visuals. Charting was accepted in place of analysis in many agencies. Then 
training and practice were revised to focus on link analysis, for example. 
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rather than link charting. 11 Link analysis was a several-step process, while 
link charting was one of several products within the process (see Figure 1). 

The need for critical thinking and cogent questioning of the data was also 
recognized. Further, LE managers believed that analysis without conclusions 
and recommendations was incomplete. 

LE-IC Collaboration After 9/11 

After 11 September 2001, law enforcement agencies expanded their 
previous commitment to collaborate more with each other and with the IC. In 
March 2002, the International Association of Chiefs of Police’s Intelligence 
Sharing Summit called for a national intelligence plan. A Global Intelligence 
Working Group was formed, funded by the Bureau of Justice Assistance. The 
Working Group included over 30 state and local intelligence personnel who 
met quarterly with representatives from the FBI, DEA, Homeland Security, 
and others. The result was the National Criminal Intelligence Sharing Plan 
(NCISP). 12 The Plan mandated that IALEIA create standards for analysts and 
analytic products. Completed in 2004, IALEIA and the Bureau of Justice 
Assistance published a booklet detailing those standards. 13 The Global group 
also created standards for the fusion centers that were being established across 
the nation. 14 Fusion centers are supported by the Department of Homeland 
Security and generally include representatives from federal, state, and local 
LE agencies, as well as the IC, working together with an all-crimes focus. 

Another outgrowth of the terrorists’ attacks is the increased training of 
state and local law enforcement officers on terrorist indicators, the role of 
intelligence, and the importance of reporting all suspicious activity. The 
fusion centers, state-level counterterrorism centers, and Joint Terrorism Task 
Forces sponsored by the FBI sharpen police officers on the street to notice all 
potentially dangerous behavior and report it to municipal or county counter- 
terrorism coordinators, who then push the information up the chain to the FBI 
and other members of the IC. Clearly, homeland security rests increasingly in 
the hands of police officers on their beats. 

One joint LE/IC training effort, the Research and Intelligence Analysis 
Program (RI/AP), started at Mercyhurst College in Erie, Pennsylvania. A 
resulting textbook. The Community Model: A Basic Training Curriculum 



Marilyn B. Peterson, "Product vs. Process, ’ IALEIA Journal 11, no. 1 (Winter 1998): 1-13. 

12 

Global Intelligence Working Group, The National Criminal Intelligence Sharing Plan, 

October 2003, URL: <it.ojp.gov/documents/NCISP_Plan.pdf>, accessed 1 November 2006. 

13 

“Law Enforcement Intelligence Analysis Standards,” Information Technology Initiatives, 
URL: <it.ojp.gov/documents/law_enforcement_analytic_standards.pdf>, accessed 1 November 
2006. 

14 

“Fusion Center Guidelines,” Information Technology Initiatives, URL: <it.ojp.gov/ 
documents/ fusion_center_guidelines.pdf>, accessed 1 November 2006. 



for Law Enforcement Analysts, included inputs from DoD, the National 
Guard, the Navy and Marine Corps Intelligence Training Center, the Coast 
Guard, and several federal and local law enforcement agencies (see Figure 
2). Participating centers included the National Drug Intelligence Center, the 
National White Collar Crime Center, the RISS projects, the HIDTAs, and 
the Federal Law Enforcement Training Center (FLETC). As its initial name 
(Generic Intelligence Training Initiative) implied, it was designed for export 
across the boundaries of LE and the IC. 



• Introduction to Intelligence 

• Intelligence Analysis as a Thought Process 

• The Planning Process in Intelligence Production 

• Basic Intelligence Collection and Evaluation 

• Introduction to Analysis 

• Data Management 

• Crime Pattern Analysis 

• Association Analysis 

• Flow Analysis 

• Telephone Record Analysis 

• Financial Analysis 

• Developing Indicators 

• Practical Approaches to Producing Strategic Intelligence 

• Managing Investigations through Managing Information 

• Intelligence Report Writing 

• Effective Briefing Techniques 

• Effective Presentations Using Microsoft Powerpoint 



Figure 2. Law Enforcement Analysts’ Curriculum 

Source: The Community Model: A Basic Training Curriculum for Law 
Enforcement Analysts (Washington: Counterdrug Intelligence Executive 
Secretariat, March 2003), 1 . 

Law Enforcement continues to learn from the IC. A presentation on 
warning analysis at the IALEIA 2005 Annual Training Conference in 
Alexandria, Virginia, was inspired by the work of Cynthia Grabo (CIA) 
and John Bodnar (DIA, now with Science Applications International 
Corporation). Some of the graphics from the presentation are seen later in 
this paper (Figures 4, 7, and 8). 

Several initiatives have combined analytical techniques from both sides 
of the intelligence aisle (see Figure 3). These include setting up the Counter 
Narcotics Trafficking office; funding and supporting Office of National Drug 
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Control Policy and HIDTA projects; working on counter-narcotics with the El 
Paso Information Center; and establishing Joint Action Task Force locations 
with law enforcement officers embedded. 



Intelligence 

Community 


Used by Both 


Law Enforcement 


Denial and Deception 


Link Analysis 


Communication Analysis 


Indications and Warning 


Matrix Analysis 


Discourse Analysis 


Cultural Awareness 


Indicator Analysis 


Crime Analysis/Forecasting 


Multi-Dimensional Analysis 


Timelines 


Financial Analysis 


Imagery Analysis 


Critical Thinking 


Commodity Flow Analysis 


Structured Analytic Thinking 
Techniques 


Analysis of Competing 
Hypotheses 


Activity Flow Analysis 




Geographic Analysis 




Document Exploitation 


Visual Investigative 

Analysis 


Psychological Profilina 



Figure 3. LE-IC Analytical Techniques 

Source: Author. 

One final example of collaboration between LE and IC was the post- 
9/11 Realities series organized by the International Association of Chiefs of 
Police (IACP) and funded by the Bureau of Justice Assistance. The resulting 
booklets included topics like Intelligence-Led Policing: The New Intelligence 
Architecture ; 15 Multi- Jurisdictional Partnerships for Meeting Regional 
Threats; Engaging the Private Sector to Promote Homeland Security, and 
Assessing and Managing the Terrorist Threat. The terrorist threat booklet 
was written by a Department of Defense staffer on loan to IACP. 16 

LAW ENFORCEMENT INTELLIGENCE ANALYSIS 
PRODUCTS 

The primary products developed by law enforcement analysts in the 1970s 
and 1980s included telephone record analysis, link analysis, and an occasional 
overview of a crime group. 



15 Marilyn B. Peterson, Intelligence -Led Policing: The New Intelligence Architecture, URL: 
<www. ncjrs.gov/pdffilesl/bja/21 068 l.pdf>, accessed 1 November 2006. 

1 ^ Joel Leson, Assessing and Managing the Terrorist Threat , URL: <www.ncjrs.gov/pdffiles 1/ 
bja/210680.pdf>, accessed 2 November 2006. 
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Telephone record analyses 

Analyses of telephone records were once the most common product in LE 
analysis and included information on dates, times, and locations of mostly 
long-distance telephone calls, with patterns highlighted. An electronic device 
called a “dialed number recorder” or “pen register” captured outgoing calls 
as well, with the times the phone was taken “off the hook” and placed back 
noted. The times and dates of incoming calls could also be captured, but 
not the number making the incoming call. (Today, caller ID makes more 
information available, as do cell phones, which give the phone numbers of 
calls made and received. Text and e-mail messages can be analyzed using 
similar techniques. This field has grown to the point where hundreds of 
thousands of call records in large databases can be analyzed to determine 
links, patterns, and anomalies.) 

A follow-up technique to telephone record analysis, discourse or statement 
analysis, is performed on written documents or transcripts of conversations. 
This provides signposts to determine (in some cases) if the statements being 
made are true, who the dominant participant in the conversation is, and what 
that may mean. When law enforcement performs electronic surveillance, it 
records conversations pertinent to criminal activity. It is the transcripts of 
these conversations that are analyzed to glean further insights into the nature 
and structure of networks and syndicates. 

Link analysis 

Link analysis consists of link charts showing who is connected to whom. 
These charts are based on physical surveillance reports, as well as telephone, 
payment, and business records (incorporation papers or bank account data). 
Charts make effective courtroom graphics and can help persuade a prosecutor 
to bring a case into court. In the world of hierarchical crime (organized crime 
and outlaw motorcycle gangs, for instance), who is where in the hierarchy 
can be very important. 

By the 1990s, law enforcement intelligence analysis was used in a 
plethora of police units. As criminals became more sophisticated, so too 
did law enforcement’s incorporation of new techniques and products. Event 
flow charts and timelines showed events leading up to or occurring during 
criminal acts (see Figure 4). Visual investigative analysis (VIA) was used 
after its success in the court case on the Robert F. Kennedy assassination. It 
allows task forces and other multi-jurisdictional groups to track the progress 
made in varied investigative efforts. The resulting charts, highly detailed, 
may take up several large walls of a room. 

Other flow charts included timelines to show events leading up to or 
through a particular activity. Commodity flow charts showed how stolen cars, 
laundered money, or smuggled weapons moved. Activity flow charts allowed 
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the overall scheme to be seen and gave a macro view of the criminal activity. 
Trends could be spotted in these graphics, as well as anomalies. 

The financial analysis of bank and business records is necessary as 
businesses are often used as “fronts” for criminal activity or are purchased 
with criminal proceeds. Net worth analysis and source and applications of 
funds analysis were introduced by the Internal Revenue Service and adopted 
by LE agencies. These techniques allowed investigators and analysts to show 
unidentified sources of income that were not reported to authorities and thus 
might be illegal. Bank record analysis techniques were developed by federal 
and state agencies to look at criminal assets and the techniques used by 
money launderers. 

Logic and inference development were part of law enforcement intelligence 
analysis since its beginnings. Probability has also been taught since early 
days. Critical thinking came onto the radar screen of law enforcement in 
the mid-1990s when it was seen that inference development cannot be done 
in a vacuum. The questioning aspect of critical thinking is now taught in 
most analytic courses. So, too, is the Analysis of Competing Hypotheses, as 
advanced by Richards J. Heuer Jr. His book, The Psychology of Intelligence 
Analysis, won an IALEIA award in 2000 for the most significant literature 
in the field of intelligence analysis. However, the method of critical thinking 
adopted by several IC agencies (NSA and DIA, for instance), based on the 
work of Richard W. Paul and Linda Elder and developed further by NSA 
analyst David Moore, 17 has not yet been fully explored by law enforcement. 

Geographic analysis is a mainstay of local police departments, which 
use pin maps to track homicides, burglaries, and auto thefts. Geographic 
information systems can now overlay various activities, uncovering 
criminal “hot spots” for directed enforcement by officers (see Figure 5). 
This has not generally included imagery analysis, but with the advent of 
pole surveillance cameras that capture activity at specific locations, imagery 
analysis will likely develop a more important role, at least in municipal law 
enforcement agencies. 



17 

David T. Moore, Critical Thinking and Intelligence Analysis (Washington: JMIC Press, 
2006 ). 
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Figure 5. Crime Map Example 

Source: “Robbery,” Chicago Crime.org, 
URL:<www.chicagocrime.org/types/robbery>, accessed 7 November 2006, 

used by permission. 



Additional techniques of crime analysis — time series analysis, crime 
factor analysis, predicting when and where the next crime will occur — may 
have some validity in the IC as well. For example, looking at the times, 
dates, and locations of IED or suicide bomber attacks might help prevent 
further attacks. 
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Crime Group Analysis 

Law enforcement uses matrix analysis to develop link charts but also 
to summarize data for ease of comparison. At the crime analysis level, the 
dates and times of crimes are put into matrices to complete pattern analysis 
and compare the components of modus operandi. It also helps target limited 
resources on investigative priorities. One example of this is seen in Figure 6, a 
matrix used by the Royal Canadian Mounted Police to summarize categories 
of data (the Y axis) on various organized crime groups (represented by letters 
along the X axis). This produces a rank-ordering for enforcement priority, 
with four priority targets in this case. 

Another matrix combines the attributes of a street gang, over time, to 
measure changes in its level of threat (see Figure 7). 
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Figure 6. RCMP Organized Crime Prioritization Matrix 

Source: RCMP, used by permission. 
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Figure 7. Gang Threat Matrix 

Source: Author. 



Law enforcement intelligence also exploits very large databases ( data or 
text mining). As noted above, financial records maintained by the Treasury’s 
FinCEN are reviewed to find suspicious transactions that can reflect the 
proceeds of criminal acts. Police then initiate investigations into potential 
criminal activity. In order to complete these analyses, indicators must be 
developed that flag anomalies or patterns consistent with criminal activity. 

Combinations of methods are used to portray the criminal activity more 
thoroughly. Bodnar referred in his book to “multi-dimensional analysis” 
where one format is overlaid upon another. Thus, mapping has been used 
with link chart overlays, as have time sequences (see Figure 8). 

Additional products are used in strategic analysis within law enforcement. 
Threat assessments, vulnerability assessments, and other long-range products 
are completed most often by state, federal, or regional agencies; municipal 
agencies are more concerned with current crime. The F1IDTA projects, for 
example, prepare annual threat assessments on narcotics trafficking in their 
respective areas. Fusion centers assess the threat posed by domestic or 
international terrorist groups. Financial intelligence units look at vulnerabilities 
in the financial systems. Many of these rely on open source data, as well as police 
files. Timelines, link charts, and financial analyses are used in the assessment, 
along with products such as trend analysis and statistical analysis. 

Another type of analysis done in law enforcement is post-seizure analysis. 
This is often part of a document exploitation process to derive all possible 
information from materials collected during an arrest, seizure, or search. One 
agency in the forefront of this activity in LE is the National Drug Intelligence 
Center, which uses the Access™-based software called RAID to organize and 
store the data. 

A final method used in law enforcement analysis is psychological profiling , 
also called criminal investigative analysis. This is used when looking at serial 
killers, rapists, arsonists, and other serial criminals. A listing of sociological 
and psychological traits common to this type of crime is compiled and the 
listing then compared to a list of suspects to see who fits the profile. The 
number of possibilities, often in the thousands, is then narrowed. 

OPPORTUNITIES FOR SHARING AND 
COLLABORATION 

This review of analysis methods and products used in Law Enforcement 
provides a reference point for IC members to compare these methods and 
products with those used in the IC. From the perspective of an individual who 
has spent a long time in LE and has been in the IC less than a year, several 
areas of potential IC use of LE techniques seem possible. 

Some of the LE techniques listed are highlighted in the Analytic 
Competency Framework forwarded by the Office of the Director of National 
Intelligence (ODNI) in the fall of 2006. These include Network/Link Analysis, 
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Figure 8. Link Chart in Time Order Setting — Multi-Dimensional Analysis 

Source: Author. 



Open Source Intelligence, Visual Investigative Analysis, and Indicator 
Analysis as analytic techniques used within the Intelligence Community. 
Timelines, the Analysis of Competing Hypotheses, and matrices are also 
topics recommended for inclusion in new analyst training. 

Financial intelligence analysis may also be helpful to at least the counter- 
drug, counter-terror, and homeland security aspects of the IC. The previous 
emphasis on economics and macro views is also important, but terrorists 
need money to buy weapons, travel, and train, for example. Thus, being able 
to “follow the money” may be key . 18 

Flow analysis (commodity, event, and activity) can help the IC track the 
movement of people, weapons, nuclear materials, human cargoes, drugs, and 
terror paraphernalia. While these techniques are, presumably, used to some 
degree already, they are not taught in current classes and are not evident in 
the ODNI core competencies. 

It might be worthwhile for the IC to focus its training more on the 
analytic process (as LE has done in the area of link analysis, for example) 
instead of on products that support briefings. As it is, the training and core 
competencies seem to emphasize shorter-term products (reporting and tactical 
developments, for example) rather than strategic products dealing with long- 
term implications. 

The IC also has many techniques that could be helpful to LE. Warning 
analysis, including denial and deception techniques, is as applicable to 
law enforcement as it is to the IC. Cultural intelligence appreciation is a 
critical skill in many police departments, since the United States reflects 
many cultures. 

Law enforcement needs to expand its understanding of critical thinking 
and structured analytic thinking techniques. While law enforcement has 
been moving in this direction, its classes still lack the depth available 
within the IC . 19 

More joint conferences and training between the IC and LE would be 
advantageous. It should not be left to analysts with interests outside their 
particular assignment to discover that there are methods available that could 
help them. Open Source Intelligence (OSINT) makes many documents and 
methods available that could instruct both sets of analysts. 

Law Enforcement intelligence analysis and IC intelligence analysis have 
coexisted with little formal interplay between them and have nonetheless 
arrived independently at some of the same places. Further sharing of 
methodologies will strengthen their individual work and also make them 
better collaborators in defense of the nation. 



18 . . . 

Anew Financial Intelligence Seminar* is currently offered at DIA’s Joint Military Intelligence 
Training Center on a quarterly basis. 

^ Specifically, a course similar to the NS A/DI A course on Critical Thinking and Structured 
Analysis should be made available to law enforcement analysts. 
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UNMASKING NETWORKS: 

DRUG ENFORCEMENT ADMINISTRATION 
TRADECRAFT 

FOR THE INTELLIGENCE COMMUNITY 

Gloria Freund 

Fellow, Center for Strategic Intelligence Research 

The IC never signed on enthusiastically to the counter-drug mission. 
Counter-drug intelligence analysis has evolved separately from more 
traditional IC problem sets. Counter-drug analysts in DIA, for example, have 
long been housed across town from other analysts, who were working order 
of battle, force capability, infrastructure, and other conventional foreign 
intelligence problems. Over the years, these CD analysts had little if any 
interaction or cross-feed with their counterparts — either about potentially 
overlapping subject matter or about analytical tools and techniques. 

The Department of Justice’s Drug Enforcement Administration (DEA) is 
even further removed. A small group at DEA has recently been re-admitted to 
the IC. It is even more distinct in its mission, focus, and institutional culture. 
Compared to conventional IC analysis, DEA counter-drug analysis, especially 
at the field office level, is akin to unique animal species that have evolved in 
isolation on the Galapagos Islands: It uses distinct analytical tradecraft that 
few IC analysts working traditional problem sets would recognize. 

Yet some asymmetric problems with which the IC now struggles have 
more in common with asymmetric drug networks than with foreign states 
or armies. For cracking drug networks, DEA counter-drug analysts have 
been plank owners of unique models and techniques that confer “survival 
value” and that they have continued to refine. Insights from their models and 
tradecraft can assist in solving a broader set of intelligence problems. 

DEA’s structure and tradecraft illuminate three particular areas of interest 
to the IC: 

• the tailoring of counter-drug intelligence to explicit and 
clearly-understood user purposes; 

• the HUMINT focus of its strategies and proactive source- 
development for generating new information; and 

• the recognition of illegal service providers as a key for 
unlocking the networks of those using them — whether for the 
narcotics trade, other criminal activity, or terrorism. 
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DISTINCT MISSIONS, BUT SIMILAR PROBLEMS 



Formed within the Department of Justice in 1973, DEA has more 
experience than the IC in counter-drug work. As a component of the 
Department of Justice, DEA also has different purposes for its counter- 
drug intelligence analysis. While the IC provides cogent estimates about 
foreign situations to help decisionmakers determine a course of action, 
DEA assembles evidence that will lead to arrest and conviction. DEA 
evidence is useful only if unclassified, accurate, relevant, specific, factual, 
and admissible in court. 

DEA field offices are distinct in having defined their intelligence problems 
wholly through the lens of enforcement purpose and criteria. These offices 
have shaped the structure and tradecraft of intelligence to support that end. 
In other words, the “mission” of DEA field office intelligence has shaped 
the “means” to achieve it. This basic mission approach is distinct from 
the traditional intelligence “capabilities-based” approach to structure 
and problem-solving. Accordingly, DEA field offices offer an alternative 
approach that can perhaps illuminate current IC moves to generate more 
relevant, actionable intelligence through user-driven Joint Intelligence 
Operations Centers (JIOCs). 

NEW IC PROBLEMS NEED NEW SOLUTIONS 

In years past, DEA’s counter-drug mission seemed worlds apart from IC 
missions like monitoring and warning of threats from foreign states, militaries, 
weapons systems, infrastructures, arms transfers, and so forth. Consistent with 
a mechanistic view of the world, the IC has long programmed and structured 
much of its largely technical collections and analytic elements around places, 
objects, masses, movements, and other “observable” phenomena associated 
with those traditional problems. A disadvantage of that structuring is a pigeon- 
holing effect: most analysts do not get to see the bigger picture. In addition, 
few analysts interact directly with the users of their product. 

Events of 11 September 2001 demonstrated that traditional procedures 
can miss critical threats. Although the details may be murky, the importance 
of networks among groups, small cells, and individuals who organize to act 
against us without leaving “observable signatures” is clear. These networks 
have adeptly exploited our mindsets, structures, and technologies — whose 
advantages are no longer uniquely our own. These threats confound further 
by remaining below the level of traditional nation-state governments, armies, 
and the other familiar constructs around which America’s conventional 
intelligence collection and analysis infrastructure is designed. Indeed, 
our enemies have formed networks among themselves for achieving their 
objectives — whether their affiliation is for convenience or shared grievance. 
Many of these networks are invisible to Cold War-legacy collection systems 
and analytic tradecraft. Groups and individuals have also prospered by 
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exploiting the walls and disconnects between these legacy systems, structures, 
and tradecraft. 



The relational essence of many critical intelligence challenges, and the 
need to develop actionable intelligence, commends a closer look at the 
user-focused, HUMINT-centric intelligence model that DEA field offices 
use. These offices have refined intelligence tradecraft to expose and explain 
relationships that enable them to find and apprehend drug criminals. This 
is not to force problems like terrorism or insurgency into a DEA-style law 
enforcement paradigm. Rather, it is to recognize and harvest useful new ideas 
for intelligence, even if they come from outside the IC. 

BCO MODEL: CONNECTING DOTS BEARS FRUIT 



DEA’s Bangkok Country Office (BCO) in Thailand offers a rich case 
study for seeing more of the whole of an “asymmetric” problem built upon 
relationships and network behaviors. A major center for international trade, 
Thailand is also a base of operations for several drug trafficking networks. 
And Thailand’s four southern provinces (see Figure 1) are beset with the 
problem — tangential, for drug-enforcers — of rising Muslim terrorism that so 
far has resulted in more than 800 deaths in less than two years. 




Figure 1. Southern Thailand Coastline 

Source: Author. 



BCO’s development of cases for prosecution thus offers a useful glimpse 
into an alternative structure and process for solving a complex, difficult 
intelligence problem — a relational problem whose true scope would be all 
but invisible were analysts using only national technical means and other 
conventional IC methodologies. 

BCO has refined its intelligence tradecraft especially for discerning 
relationships within shadowy networks, for teasing out and proving the 
activities of individuals involved in the drug trade. The big business of making 
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money through narcotics trade requires access to reliable, professional- 
grade illegal support services. These services include smuggling and 
couriering goods and people, transferring and laundering money, and forging 
documents — including stealing or generating fake passports, visas, drivers’ 
licenses, birth certificates, identity cards, SSNs, and other credentials. Such 
services enable the business to operate profitably and the network to move 
its products efficiently beneath official radar. BCO has found that discerning 
the specific relationships among drug traffickers and such illegal service 
providers has been one of the best ways to discover the scope, activities, and 
behaviors of the drug network itself, as well as a means of identifying higher- 
level operatives. 

Hound Dog: A Short Foray across Mission Boundaries 

In the course of assembling the puzzle pieces of narcotics trade networks, 
BCO has seen that, just like drug dealers, terror networks need to move 
resources invisibly across national borders. They often do so using international 
or underground financial systems, including Chinese Underground Banking 
Systems (CUBs) or Hawala, an informal South Asian financial transfer 
system. Other techniques involve debit/credit cards and Western Union, 
methods through which guest-workers worldwide have transferred roughly 
$48 billion in a single year, according to BCO’s estimates. Through studying 
these behaviors, methods, and linkages, BCO analysts have realized that 
terror networks are using many of the same professional providers for false 
identity papers, money laundering, and courier services. 

Thus, through Special Field Intelligence Program initiatives such as 
Operation Hound Dog, 20 BCO analysts have discovered in the course of their 
CD work a critical and identifiable nexus of professional, shared “service” 
contacts. Because these same contacts are exploited both by drug traders 
and terror organizations, BCO analysts daring to peek over the walls of 
their prescribed mission can suggest to the IC that the details of these shared 
contacts offer a window into both types of networks. Developing a full picture 
of service industry contacts and relationships like those in Thailand could 
illuminate a good deal more — not only about drug networks and trafficking, 
but also terror organizations and activities. BCO has been investigating 
African and South Asian illicit service providers based in Thailand because of 
their support to drug smuggling. But BCO’s findings that individuals linked 
to the Middle East and to terrorism are also using these services have drawn 
high interest from Thai law enforcement and military authorities, including 
those concerned about the unstable, Muslim-dominated southern provinces. 
Thai military authorities believe that the terror problem in the south is being 



20 

DEA Intelligence Officer, Bangkok Country Office. Bangkok, Thailand, interview by 
author. May 2006. 



24 



enabled and exacerbated by drug networks that push drugs to embolden 
youths to commit acts of terrorism . 21 

Although the IC certainly uses forms of link analysis and document 
exploitation, BCO analysts have not yet attracted much interest from the IC 
for their particular relational methodologies or for the service provider details 
and insights that might be relevant to terror networks. BCO speculates that 
its narrower counter-drug mission may be obscuring its information’s other 
uses from IC analysts. There may also be an assumption, justified or not, that 
any relevant information is already passed by the FBI to IC counterterrorism 
centers. However, it does not appear that the IC is harvesting all the potentially 
relevant information and insights being captured by organizations like the 
BCO. Illegal service industry connections, and the BCO relationship-focused 
methodology in general, offer innovative and potentially valuable analytic 
pathways into any hard target network whose daily functioning requires 
professional-grade illegal support services. 

“Ends” Shape Structure and Means 

The clear ends for BCO’s counter-drug intelligence analysis define its 
analytic structure and tradecraft. These ends are obtaining the evidence 
required to arrest individuals engaged in money laundering, counterfeiting, 
and other illegal activities related to drug trade, while also gathering additional 
evidence and exposing higher-order drug-trade criminals and their activities. 

According to BCO, the African Criminal Network (ACN) is one of the 
largest Thai-based narcotics networks. It comprises one of BCO’s largest 
“intelligence problems.” ACN is comprised of often-related Ghanaians and 
other western Africans. This network also has links to other networks and 
individuals in Southeast Asia, South Asia, Europe, the Middle East, and 
Latin America. These large networks have tentacles reaching the U.S. 
They use family, business, religion, or charity cutouts to obtain the gamut of 
fraudulent document and fund-transfer services they need to function. 

BCO has developed tradecraft and analytic techniques to produce insights 
and gather usable evidence about such networks and their members. 

Integration of Intel and Ops for Actionable Intelligence 

About two years ago, DEA’s need for accurate, specific actionable 
intelligence led it to restructure its held offices for producing just such 
insights. At BCO Bangkok, DEA has developed task-force-like teams to 
build cases. Each team has embedded seasoned intelligence analysts working 
alongside special agents executing operations and enforcement actions. 
These analysts and agents have Thai language skills and are immersed 
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Special Colonel Duangkamal S. Makes wat, Director, Division 4, Armed Forces Security 
Center, Bangkok, interview by author. May 2006. 
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in Thai culture (see Figure 2). They also work directly with and in support 
of Thai law enforcement organizations, which in turn can draw from Thai 
sources of additional information and directly from Thai criminal elements. 

The analyst offers “reach-back” capability to various law enforcement 
databases. The Special Agent brings law enforcement experience, street 
smarts, and undercover resources and information. 

The BCO Special Agent and the rest of the problem-solving team are 
the intelligence analyst’s main product users. However, the agent and 
other team members also comprise the analyst’s most critical intelligence 
sources. Viewing the user as an intelligence source is an essential aspect 
of a sustained Intelligence-Operations conversation that produces 
“actionable intelligence.” 

Thai law enforcement and military counterparts are also full members 
of this team, as detailed below. Each member of these close-working 
BCO-host country teams comes to learn much about the responsibilities, 
capabilities, and requirements of all the others. This gives all members 
a more complete picture and context for the particular expertise or 
resources they bring to solving the problem. In terms of output, BCO 
intelligence analysts also prepare analysis cables back to HQ, which 
HQ may then incorporate into strategic assessments. However, BCO 
intelligence analysts contend their most important output is the routine 
brainstorming among their team and with their agent (“operations”) and 
providing amplifying insight about the case as it is developing. 22 

The mission and daily risk that DEA special agents confront means 
that, just like military units preparing for combat, they must have the 
fullest possible situational awareness. BCO “Intelligence” (analysts) and 
“Operations” (agents) suffer no blue doors or green doors — the security, 
cultural, and bureaucratic barriers infamous for preventing intelligence 
analysts from knowing about operations or operators from knowing about 
intelligence insights. The needs of the case drive the BCO intelligence 
strategy, and the agents have immediate access to all insights about the case 
that the intelligence analysts produce. As such, BCO offers a useful living 
example of producing actionable intelligence for the user. 

Every BCO agent and analyst interviewed by the author emphasized the 
importance of agents and analysts being physically co-located and teamed 
on cases. They insist that this enables BCO intelligence analysts and 
agents to sustain a necessarily continuous, actionable intelligence-oriented 
conversation about the status of the case on which they are both focused. 
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DEA Counter-drag Analyst, Bangkok Country Office, Bangkok, Thailand, interview by 
author. May 2006. 
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Figure 2. Mendicant Buddhist 
monk in Thai market 

Source: Author. 



One 20-year special agent, 23 who now runs a training academy for Thai law 
enforcement officers, elaborated that no regimen of written messages, emails, 
or VTCs produces better results than people with relevant skills working the 
problem together, side by side. 

Even when under cover, agents provide immediate “tactical” updates to 
their intelligence analyst as they discover possible clues and new associations 
during surveillance, confidential interviews, or undercover activities. The 
means for providing updates and brainstorming entails no arcane technologies, 
fusion tools, or software; it consists of frequent face-to-face conversations 
and cell phone calls. 

This direct and continuous communication contrasts with the prevailing 
form of IC analyst-user interface. IC intelligence users at higher echelons 
typically “task” questions through liaison officers and collection requirement 
mechanisms. These are passed down through the intelligence bureaucracy’s 
administrative echelons, through supervisors, and finally to analytic 
elements — with whom the users have little or no working relationship. 
Isolated and remote from their users, analysts have little exposure to or real 
grasp of the user’s milieu, perspective, or mission. Users in turn have little 
knowledge of the analysts’ capabilities and limitations. 

BCO’s continuous direct intelligence-user interaction as a form of output 
also differs from the IC’s tendency to “offer” intelligence judgments in 
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Chief, International Law Enforcement Academy, Bangkok, Thailand, interview by author, 
May 2006. 
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formal publications or by posting product on web pages for users to find. 
This is often done unbeknownst to potential users, who may not discover 
relevant products while web surfing. An actual intelligence conversation 
between the line 1C analyst and the user is rare. Moreover, while much of the 
IC’s user world works on unclassified and secret level systems, 1C analytic 
elements work and post their product on JWICs, a system that most users 
cannot even access. 

BCO intelligence analysts research new leads as they receive them from 
U.S. and host country contacts, databases, operations, and other inquiries. 
The analyst and agent collaborate to decide what and how to follow-up. 
The two often interview confidential sources together so they can share 
impressions and brainstorm about follow-on plans. New data often add 
new branches for Operations or Intelligence inquiry to the case; some lead 
to entirely new cases. Agents and intelligence analysts thus collaborate at 
every step — forming objectives, conducting interviews, seizing emerging 
opportunities, evaluating the quality of information from a source, forming 
hypotheses, determining evidence gaps, and developing follow-on strategies 
to fill the remaining gaps. 24 Agents do not view themselves as or want to be 
analysts, or vice versa. Yet over time, close teaming and common focus has 
tended to build trust while enabling each to know the other’s capabilities 
and perspectives. 25 

Rules of Evidence Define Case-building Criteria 

BCO intelligence analysts begin to build a case by defining their 
intelligence problem against the user requirement that evidence meet the 
arrest and prosecution threshold. Requirements also guide the sources 
and methods that BCO analysts use to discern the scope of the network. 
Requirements also inform the analysts and agents when the evidence they 
have built is enough to elevate the case to a higher priority (thus receiving 
increased investigative resources), or to hand over for enforcement action. 

The clarity of enforcement criteria and purpose contrasts with the often 
vague understanding many intelligence analysts have of the ultimate 
application and consequence of their analytic tradecraft and judgments. 
BCO counter-drug analysts know in advance that their conclusions and 
supporting evidence must be accurate, specific, and admissible in court. 
That is unlike strategic estimates pertaining to foreign political situations, 
which may bridge evidence gaps by drawing on supposition, logic, or past 
patterns. 26 Each defendant in counter-drug work is different and every case 
is judged on its own details and merits. Consequences of success and failure 
are immediate and palpable. Moreover, if analysts receive information 
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DEA Special Agent, Bangkok, Thailand, interview by author. May 2006. 
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DEA, interviews. 
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from sources (for example, classified intelligence) or employ methods (for 
example, extra-legal wiretaps) that led them to conclusions but are not 
admissible in court, they know they must also have admissible evidence 
that can support their conclusion. In this way, the end requirement 
defines nearly everything about counter-drug intelligence sources and 
analytic tradecraft. 




Figure 3. Market in northern Thailand’s Golden Triangle 

Source: Author. 



In getting tip-offs that may lead them to open cases, BCO analysts say they 
get little help from conventional intelligence sources, methods, or tradecraft. 
One analyst, who was conversant with the IC from working at DIA for nearly 
20 years, said that in four years on station in Bangkok, only one worthwhile 
lead came from national intelligence sources. 27 Conventional intelligence 
data tend to be highly classified. Classification greatly complicates sharing 
with host-country teammates and is not useful for court proceedings. 

The limited use of national intelligence for BCO purposes is also due in 
part to the more strategic, general, or estimative orientation of most national 
HUMINT or national technical collection requirements and the data they tend 
to produce. Generally, national means are neither directed against, nor do 
they produce, the tactical data or detail needed to construct a case. Moreover, 
where the IC may weave imprecise or inaccurate details from HUMINT 
into a strategic IC product without having palpable (or at least recognizable) 
consequences, the same is not true for a BCO agent interfacing directly with 
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criminal elements. Inaccurate details in the agent’s understanding of his target 
can put the agent in danger and raise the risk of operational failure. 28 

Host Nation as Full Team Member 

For their case-opening leads, the BCO has a multitude of alternative 
sources. Among the most important are the tip-offs received from partnerships 
cultivated among local (Thai) police, immigration, military, and other 
officials. These officials have overlapping or mutually reinforcing objectives 
with BCO, and understand the BCO’s “case building” needs. In this way, 
“interested users” from the host country become involved in working the 
“intelligence problem” with BCO from its inception. They are gateways 
into a multitude of Thai immigration, telephone, police, banking, and other 
organizations and databases that can offer specific follow-up information 
about particular cases with a Thai connection. BCO analysts and agents 
routinely meet and talk directly with host country officials. 

Thai organizations suffer their own “stovepipe” syndrome, and BCO 
teams often act as the hub of the wheel in collating information from disparate 
organizations. Thai law enforcement and military officials are looking to 
apprehend drug criminals within Thailand and, from a military perspective, 
maintain stability where drug activities may be exacerbating violence. Thus, 
the Royal Thai Police’s Narcotic Suppression Bureau, the Thai Office of 
Narcotics Control Board, and the Justice Ministry’s Department of Special 
Investigations (all law enforcement offices) are, like the Special Agent, 
intelligence users as well as intelligence sources. In effect, Thai officials 
are full working partners supplementing the core BCO analyst-agent team. 
Working almost wholly at the unclassified level enables BCO to sustain a 
robust and continuous intelligence conversation with Thai officials. This is the 
type of relationship intended for DoD’s new JIOCs: established mechanisms 
for operators to become intelligence sources as well. 

One of the BCO’s largest ongoing cases is that of a West African money 
launderer and suspected drug trafficker. BCO opened that case with a tip- 
off from the Royal Thai Immigration Service. In early 2006, Immigration 
apprehended the African male for the seemingly simple problem of his 
attempting to enter Thailand on a false visa. They then made available to 
BCO some of the suspect’s possessions. These included several bank/debit 
cards from China and Thailand, several phone numbers, a business card for 
a firm that does check-cashing and Western Union transfers, and “world 
citizen” identification. It later surfaced during a BCO interview with the West 
African suspect that, before he arrived in Thailand, the Japanese had held him 
for a month for traveling on a false British passport. (The suspect maintained 
he was waiting for his “real” passport to arrive from his mother.) Although 
Thai officials subsequently released the suspect and deported him from 
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Thailand, BCO opened a file to follow the suspect’s suspicious activities as a 
money laundering case, although analysts also suspected that other crimes or 
criminal associates were involved. Those suspicions grew after one of BCO’s 
confidential sources alerted them that the individual subsequently re-entered 
Thailand. At that point, BCO set out to uncover the truth and scope of this 
suspect’s activities and associations. 

Precise and Proactive HUMINT 

BCO relies heavily upon HUMINT to get leads and develop follow-on 
information. However, BCO strategies for developing HUMINT are beyond 
those of DoD, where few analysts have even indirect access to sources, and 
where — at best — they may attempt to pull further information from a source 
through written guidance comments in a formal evaluation. BCO’s HUMINT 
encompasses an entire strategy or menu of searches, direct interviews, 
surveillance, and proactive operations, any or all of which can be used to 
build and verify the evidence. 



Databases to Amplify Personal Information. Depending on the nature of 
the tip-off, BCO intelligence analysts begin by querying multiple, sometimes 
mutually reinforcing sources to fill in the picture of the activity or of the 
individual suspect and his relationships. They may check FBI, national, and 
DEA proprietary databases to see what more they might reveal about the 
piece of identifying data that they have received about a suspect. 



Most such criminals cover their tracks by using multiple names, cutouts, 
SSNs, disposable “one-two” cell phones, addresses, and so forth. This 
increases the importance of using multiple sources and databases. Only by 
comparing data received from many sources and databases is it possible to 
discover common threads pointing to true identity, relationships, location, or 
nature of activity. Despite the value of its databases, however, filling in the 
relationship and identity picture usually entails far more. 

Toll Analysis. Toll analysis is a basic methodology, versions of which 
have been adapted to other problems, that drills down on individual suspects 
and their particular relationships and activities. It does so by identifying calls 
made and received from a given phone number either found on or contacted 
by the suspect. 

Albeit detailed and tedious, toll analysis is a foundational tool for starting 
to build the links and key nodes of a network. Toll analysis relies on the 
ability to track telephone calls, whether landline or mobile, in a way that 
enables analysis of their patterns of direction, repetition, frequency, and 
duration. BCO intelligence analysts note common numbers, numbers called 
by more than one other number. This may offer additional clues and patterns 
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about the subscribers’ contacts. Analysts can then use digital dial analysis 
or a comprehensive toll analysis in the NCIC database to see what other 
phone numbers had calls to or from any of the numbers in question. This 
analysis exposes further associations, albeit not yet the associations’ content, 
and it can lead to links with other cases under investigation. Applying their 
experience and grasp of typical target behavior, BCO intelligence analysts use 
the patterns to develop tentative working hypotheses about the associations. 
In some cases, analysts can determine identity of phone subscribers as well 
as call location. 



Despite the significant reference value of toll analysis, BCO intelligence 
analysts also recognize that their case cannot rest on toll analysis alone . 29 
Doing so would entail the same error as a conventional analyst believing 
that, despite all its value as a reference, overhead reconnaissance can reveal 
the entire story about a situation. Toll analysis is itself a model with certain 
built-in assumptions. If accepted without question, these can lead to faulty 
conclusions. The tolls do not usually directly reveal or prove the identity 
of a criminal or the nature of his offence. Subscribers subjected to repeated 
contact may turn out to be completely benign. Instead, BCO analysts consider 
toll analysis a useful starting point, one of several building blocks that, once 
established, can be the basis for further network-picture building and case 
strategizing. BCO analyzes and amplifies on initial link charts by searching 
additional U.S. and foreign databases and other DEA country field offices and 
by proactively developing other HUMINT sourcing. 



BCO analysts also, as noted earlier, provide their findings from toll 
analysis to host-country military and law enforcement partners, who can 
draw on their access to host country telephone, financial, police, and other 
records to help fill in details — whether it is telephone call content, financial 
transfers, or other useful information . 30 

In the ongoing West African case, the numbers found in the suspect’s 
possession showed useful patterns. Although there were few domestic (Thai) 
calls to the suspect’s numbers, there were multiple calls from Canada, UK, 
New York, and Japan. Another of the suspect’s Thai numbers listed several 
contacts with Chicago-area phone numbers. BCO’s toll analysis of the 
suspect’s list of numbers showed an indirect link to individuals already being 
investigated by DEA in the U.S. Repetitive calling among the UK numbers 
and a very large number of calls with Nigeria raised further suspicion about a 
triangular calling pattern. Moreover, the organization that issued the suspect 
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his “world citizenship” card had contacts with other known drug traffickers 
that were already the subject of separate investigations. 

Toll analysis has not yet linked the suspect directly with drug trafficking, 
but tolls with other information show him associated with individuals who 
are involved in those activities. Those associations do not prove guilt, but 
they are enough to justify elevating the case in order to receive increased U.S. 
and Thai investigatory resources. Then the challenge for the agent-analyst 
team will be to uncover direct evidence of his guilt. 

Layering on Other Data. Once analysts establish some type of “fingerprint” 
(a bank account or several phone numbers pointing to the same subscriber, 
for instance) by which they can track the individual or activity, analysts can 
combine what toll analysis has suggested about patterns and associations with 
other gleaned details. These may include answers to queries sent to field offices 
and databases in areas implicated by the calling/called locations. Analysts 
also can research suspicious activity reports (SAR) filed by U.S. financial 
organizations, cull credit bureau reports to see whether the individual has 
been identified in the past, and check to see if he is part of another ongoing 
case. BCO analysts additionally broaden their query to the DEA’s database 
and the FBI’s consolidated National Crime Information Center database, a 
clearinghouse combining data from other DEA field offices. Customs, FBI, 
immigration, and other agencies with a counter-drug mission. 

Many criminals increase the challenge of tracking them by using bank 
ATM cards instead of credit cards to transfer funds. ATM card transfers only 
require a card and pin, not necessarily a name. This improves anonymity, 
adding ease, transparency, and safety to money-transfer and laundering 
deposits and withdrawals. ATMs enable criminals to transfer funds from and 
to anywhere in the world, with minimal risk that lost cards will be reported. 
And they can use the same cards for point of sale purchases — to buy legal 
consumer goods that they can then sell on the black market, thus laundering 
their proceeds. 

Through SARs and/or access to Thai data afforded by the host-nation 
partnership, BCO analysts can access specific ATM withdrawal and deposit 
information and history associated with confiscated credit or ATM account 
numbers. These show the amount, frequency, time, and date data. Thai 
officials also can help localize individuals making the calls, in turn raising the 
possibility of gleaning identifying data from automated tellers equipped with 
video surveillance . 31 All such data can help amplify BCO analysts’ insight 
and working hypotheses. 
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Figure 4. Hill country village in northern 
Thailand’s Golden Triangle 

Source: Author. 



In some cases, BCO intelligence analysts, aided by Thai-provided data, 
can also gain commercial information to determine whether their suspects 
have converted any of the money into goods such as drugs or electronics for 
downstream selling as a means of further laundering. Analysts can add more 
pieces to the puzzle by overlaying the account number transfer activity with 
telephone activity they have pinned on the same individuals, addresses, or 
other identifying data. Further, they can link details of money transfers or 
goods sales with telephone call activity, layering more useful detail onto the 
link chart. It begins to reveal the larger picture of who is directing the activity, 
who is servicing the request, and at least working hypotheses about the nature 
of the working relationship and services one may be providing to or getting 
from another. 

In the case of the West African, BCO analysts’ overlaying of call patterns 
with deposit and withdrawal information showed an indirect link between the 
suspect’s telephone activity and repeated bank transfers of large amounts of 
money, strongly suggestive of money laundering. 

Confidential Source. BCO’s confidential source (CS) program is a form 
of proactive and precisely targeted HUMINT. The BCO analyst-agent team 
develops a strategy for using CSs from its knowledge of the case. The purpose 
is to produce more evidence on the target with help from individuals who 
know the target, the business, and the neighborhood, and who can be induced 
to cooperate and to provide details about the suspect’s ongoing activities and 
associations. BCO normally cultivates and turns people into confidential 
sources when it believes a CS can point to more evidence for elevating the 
case, or for amplifying a case already underway. 
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Analyzing the links and associations of its target, BCO looks for individuals 
who would likely have a particular motive — a grudge or an itch that needs 
scratching with respect to the main suspect or his associates. In part through 
undercover work, the BCO agent-analyst team becomes familiar enough 
with its sources to discern and exploit the collection opportunity that 
such motivations can offer. Candidates may be induced out of greed; they 
may be spurned lovers or cheated business partners; they may be facing 
stiff punishment for drug trafficking or related crimes and hoping that 
cooperation will be a “get out of jail” card. Other source candidates may 
find cooperation a far better choice than options such as deportation or 
hand-over to foreign authorities for interrogation. That each case differs 
means that CSs cannot be “turned” on generalities. The analyst-agent team 
must be intimately familiar with the details of the case and the personalities 
involved, must realize what is credible and available for exploitation, 
and must know what exploitation might yield. BCO compensates CSs to 
sustain their relationships with the suspect or his associates and to report 
developments from which the BCO analyst- agent team can formulate 
relevant actions for gathering additional evidence. 

For the West African case, BCO obtained cooperation from a confidential 
source who travels in the suspect’s circles, who needs money, and who 
appears repentant following a drug charge . 32 The special agent pays the CS 
to “hang around,” socialize, and pick up what he can at locations the suspect 
and/or his friends and associates frequent. The BCO intelligence analyst 
and the agent meet frequently with the CS to gain feedback and provide the 
source continuing guidance. The BCO special agent encourages the CS to 
continue cooperating through the promise of a large bonus when the case is 
resolved. The CS has provided valuable information about the suspect and his 
whereabouts, as well as information on additional associates, at least some of 
which analysts have been able to verify independently. 

Surveillance. Directly monitoring the movements of suspects is another 
proven and precisely targeted form of HUMINT that BCO uses to flush 
out more evidence and associations on suspects. BCO agents may observe 
individuals, residences, places of business travel, or whatever else might 
yield further facts about people associating with the suspect or the nature of 
their illegal activities. 

In the West African case, BCO built a joint surveillance plan with help 
from the Thai Department of Special Investigations (DSI). DSI was able to 
develop key information related to a bankcard in the suspect’s possession from 
the Siam Commercial Bank. DSI had identified the account owner, her 
address, and her businesses. From that they could, through surveillance, 
identify people with whom she lived, worked, and socialized, leading to a 
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BCO hunch that she is the suspect’s 
girlfriend. The suspect subsequently 
showed his girl friend’s picture to an 
undercover agent, confirming that 
she and the Siam bank card account 
holder were the same person. 

Knowing that, DSI believes that by 
monitoring her through surveillance 
it can confirm if and when the 
suspect returns to Thailand, and his 
subsequent whereabouts. 

Wires. After narrowing telephone 
numbers to those of greatest interest, 

BCO intelligence analysts can obtain 
Title III wiretaps on numbers it 
believes will yield additional evidence 
and associations. Wiretaps track all the 
telephone numbers in contact with the 
monitored line, along with content of Figure 5. Giving alms at 
the conversations over that line. a Buddhist temple outside 

Bangkok 

Running Operations. Once the Source: Author, 

agent-analyst team is convinced, but does not yet have irrefutable proof, that 
the suspect is engaged in drug-related money laundering, document fraud, 
or other illicit services, it may elevate the case from a “general” file to a full 
case. Elevation increases the amount of investigative funding and resources, 
to include support for crafting and running additional operations. 

The purpose of running operations is the same as all else for the agent- 
analyst team: to fill in gaps of evidence that DOJ needs to support arrest 
and court prosecution of identified criminals engaged in narcotics trade. An 
operation makes use of almost everything that the analyst and agent have 
learned about the case. The operation typically inserts an undercover agent 
or BCO-controlled confidential source as an apparent participant in the 
narcotics trade flow. This enables BCO to observe and document the suspects’ 
continuing illicit activity and associations. As such, it produces relevant 
and direct evidence. This means of gaining direct, first-hand evidence also 
precludes the kind of imprecision or ambiguity that can characterize second- 
or third-party HUMINT found in much IC reporting. 

Even though agents have the principal responsibility of running operations, 
it is not the agent alone but the agent-analyst team that formulates the 
operation and its tactics. Both members bring to bear their understanding 
about the suspect, his personality, activities, relationships, and foreseeable 
responses to the operation’s tactics; how he will react to the “customer” the 
undercover agent may pretend to be or to services the undercover agent may 
offer or seek to purchase. The undercover agent may offer to buy and make 
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payments for drugs to stimulate the network to engage in (and thereby expose 
to BCO) its “normal” activity. An operation’s duration and content depend 
on the individual situation. If an operation continues to expose new activities 
or associations to higher-order drug trade, the analyst-agent team may run it 
until convinced they have seen the entirety of the network and/or the highest- 
order criminal it is likely to bring to the surface. 

For the BCO intelligence analyst, the undercover operation often supplies 
vital new leads for additional suspects and activities related to the case. These 
may point to other higher-level criminals, and they may also offer their own 
new set of service-provider relationships. Thus, an operation can as easily 
lead to an entirely new set of suspects, to the makings of an entirely new case, 
or to linkages to cases already under investigation elsewhere in a way that 
reveals their true scope. 

Throughout an operation, BCO takes great care to allow a complete 
unfolding of the full nature and scope of the suspects’ activities and 
associations. If indictments exist against any of the suspects or their associates, 
they are sealed so that the suspects will discern no reason to refrain from their 
“normal” activity. 

Training. At the International Law Enforcement Academy in Bangkok, 
BCO has also initiated training to help host-country law enforcement officials 
learn how to work together through a case . 33 This training helps the host 
country develop cases properly as well as recognize the kind of insight that is 
useful to BCO case development. 

A seasoned DEA special agent has designed the training regimen to 
bring together a broad cross-section of law enforcement officials from Thai 
immigration, police, customs, DSI, military, and other institutions with a 
stake in the problem. The program director maintains that his courses are 
an example of how to break down stovepipes at the most essential, person- 
to-person level. He observed that many officials in his classes have been 
working aspects of the same problems, some even at the same locations, 
without realizing it. His courses offer them an opportunity to meet, realize 
their overlapping objectives, and build useful relationships with institutional 
counterparts and contacts. 

The Academy coaches its mixture of officials to solve hands-on cases from 
inception through resolution. It provides the outlines of the problem and sets 
up challenges, including “crimes” such as actual explosions of satchels or 
vehicles. The course then exercises students in using their many alternative 
sources of information for acquiring evidence to enable prosecution. 

The hands-on experience has been very successful in eroding stovepipes. 
He believes the class work and practical problem-solving experience 
increases respective institutional “buy-in” to a more confederated approach to 
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problem solving beyond the classroom. Course graduates bring back to their 
own organizations a fuller grasp of solution options, as well as advocacy for 
what interagency cooperation can accomplish. The academy chooses the top 
students within its classes to become instructors of the methodology within 
their respective home organizations. 

SUMMARY: INSIGHTS FOR REMODELING THE IC 

DEA field office intelligence tradecraft contrasts sharply with the 
intelligence model that the IC has evolved over the years for traditional threat 
analysis and that it is now remodeling. DEA’s held intelligence clearly has a 
different purpose than the IC’s. Some of its methodologies carry risk and not 
every investigation or operation has produced the intended results. Indeed, not 
all DEA held office tradecraft is applicable or appropriate to IC intelligence 
problems. Beyond that, resident expertise and fortuitous personality blends at 
BCO also contribute to the productive working relationships and high morale 
evident there. And in fairness to the IC, many of its collection or exploitation 
capabilities could help BCO analysts with their case-building. 

All that said, this analyst’s short visit to BCO was an eye-opener. This 
is especially true of the user-mission orientation of BCO’s intelligence 
structuring, the productive give-and-take with host-country officials, and 
the relationship-discerning attributes of its tradecraft. Beyond factors of 
personality or expertise among individuals assigned to BCO, the attributes 
of an enabling intelligence-operations team structure, mission clarity, and a 
rich host-country working relationship seem to be a magic combination for 
solving problems. 

This analyst left BCO convinced that, first, the IC should find a way to 
harvest whatever substantive details and insights organizations like the BCO 
discover in the course of their counter-drug work that might assist with critical 
problem sets such as terrorism. 

Second, the IC should study DEA field offices’ alternative structure and 
tradecraft to see how it might be useful, wholly or in part, in solving IC 
intelligence problems. DEA field offices have fashioned an effective approach 
to address the issues they discern. DEA accordingly has been adjusting its 
own culture to help resolve two huge challenges that similarly confront 
the IC: 1) user demands that intelligence structure its analysis to be more 
operations-integrated and relevant to user requirements (as evidenced by the 
JIOC’s Execute Order 34 ); and 2) the need to understand intelligence problems 
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in which details about individuals and relationships offer clues to activities 
of larger networks . 35 

At least as manifested by the team at the Bangkok country office, DEAhas 
insightful and fresh approaches to offer the intelligence community at large, 
if the IC is innovative and adaptive enough to grasp and adopt them. 




Figure 6. The End. 

Source: Author. 
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IMPROVING TACTICAL MILITARY 
INTELLIGENCE WITH ANTI-GANG 
TECHNIQUES 

Major Edward Gliot, USA 
Master of Science of Strategic Intelligence, 1999 

As soon as we got to Mogadishu, we were struck by the similarity 
to L.A. 



A colonel involved in the U.S. Marine 
deployments to Los Angeles and Somalia in 1992, 
as quoted by Thomas E. Ricks in 
“The Widening Gap Between the Military and Society,” 
The Atlantic Monthly 280, no. 1 (July 1997): 77. 

Problems such as ethnic confrontation, "uncivil wars,” and tribal upheaval 
are not new, but the American military’s focus on them is. By looking to 
American law enforcement’s experience with street gangs, the military may 
find some innovative ways of handling those problems close at hand. In the 
United States, urban street gangs have steadily increased their membership, 
their violent crimes, and their lethal weaponry. Because of similarities 
between civil unrest in the Third World and the U.S., HUMINT collection 
practices and tactical military intelligence analysis during military operations 
other than war (MOOTW) may benefit from incorporating successful street- 
level intelligence techniques developed by police anti-gang task forces. 36 



SIMILARITY OF FOREIGN AND U.S. URBAN 
ENVIRONMENTS 

Operations RESTORE HOPE in Somalia, UPHOLD DEMOCRACY 
in Haiti, and the continuing NATO operations in the former Yugoslavia all 
challenge the military intelligence community to provide better intelligence 
support in these chaotic environments. One promising source of untapped 
intelligence expertise is America’s domestic police departments. In 1996, 
about 4,800 U.S. police jurisdictions were attempting to maintain law and 
order against nearly 250,000 gang members in more than 31,000 street 
gangs. To accomplish their law enforcement mission, many of these police 
departments actively conduct intelligence operations dedicated to gathering 
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and processing tactical level intelligence to “understand patterns of gang 
behavior and identify trends.” 37 

Similarities of Gangs 

U.S. military strategic thinkers have recently observed the similarities 
between America’s armed criminal gangs and the warlord-type formations 
observed in the Third World. From the police perspective, the military 
nature of U.S. gangs is apparent. Law enforcement publications describe 
street gangs using armed rooftop lookouts, “contracts” for the assassination 
of specific police officers, and active deception operations. Domestic gang 
sociologists have documented the similarities between American street gangs 
and youth gangs found throughout the world’s urban areas . 38 Given these 
similarities, enforcing law and order against street gangs should require the 
same intelligence support, whether in Mogadishu or in Los Angeles. If so, 
then the intelligence methods used by domestic police forces may improve 
HUMINT collection and tactical intelligence analysis during constabulary- 
oriented MOOTW. 

Street gangs are not a uniquely American phenomenon. The need to 
belong to a larger social group is not a merely cultural attribute — it is a human 
characteristic. Street gang sociologists note that the formation of street gangs 
is a natural human response to certain environmental factors, including 
urbanization, poverty, and a widespread sense of hopelessness among 
young adults. The formation of street gangs, then, can be viewed as a human 
impulse to create social organization in a socially chaotic environment. 
Numerous modern gang researchers have observed American-style street 
gangs in such diverse locales such as Western Europe, South East Asia, 
Russia, India, Brazil, Jamaica, Tanzania, and Yugoslavia . 39 Therefore, it 
is reasonable to assume that street gangs in Haiti, Somalia, and Bosnia are 
also similar to U.S. street gangs. 
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Similarity of Military and Police Operations 

There are also similarities between military operations and police 
operations. Both police and military forces emphasize the use of human 
intelligence collection using overt methods, in uniform, with informed 
sources. In many police jurisdictions, the officers are ethnically and 
linguistically different from the populations they patrol. In a more general 
sense, police departments are armed para- military organizations. Like the 
military, they are structured on authoritarian lines and are responsible for 
establishing order by force, if necessary. These similarities, as well as the 
research outlined below, indicate that some police intelligence techniques 
can be used effectively in MOOTW environments. 

In Somali and Haiti, U.S. forces operated under a mandate to establish and 
maintain civil order, making the street gangs found there part of the threat 
forces. In Bosnia, the constabulary role is part of the military’s mission to 
the degree it is required to implement the Dayton Peace Agreement. Analysis 
of the Joint and Service Lessons Learned in these three operations, as well 
as academic studies and interviews with participants, yields seven tactical 
intelligence lessons, four on the HUMINT collections aspect of the operations 
and three on the analysis portion (see Figure 1). 



Collection 

• Every soldier is a HUMINT collector. 

• Maintain the balance between security and 
HUMINT collection. 

• “Non-standard” HUMINT information sources are vital. 

• Extracting information via HUMINT is time consuming, 
complicated, and worthwhile. 

Analysis 

• Analysts must understand the host nation’s cultural 
environment. 

• Tracking the situation requires precise resolution of 
detailed information. 

• Conventional analysis of gang order of battle and doctrine 
is impractical. 



Figure 1. Tactical Collection and Analysis Lessons 

Source: Author. 
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According to the author’s evaluation of four metropolitan police 
departments, the HUMINT collection lessons listed in Figure 1 are comparable 
to the practices developed by police anti-gang units in major U.S. cities. Like 
the Army and Marine Corps, three of the four police departments surveyed 
try to use every officer on the street as a HUMINT collector. The police have 
also developed collection team structures and security measures analogous 
to the military solutions that evolved in Somalia, Haiti, and Bosnia. The 
use of unusual information sources was a common aspect of the military 
and police collection procedures. The police experiences also reinforce the 
military lesson that, although the expenditure of time, effort, and resources to 
develop informants is high, it is a worthwhile investment. Finally, the police 
departments in the larger cities, like the military in Haiti and Bosnia, found 
surveillance to be effective but cost prohibitive. 

In the analysis area, police investigators acknowledge the need to understand 
the unique street gang “culture” and environment from a broad economic, 
social, and psychological perspective. Like the military analysts in Somalia 
and Haiti, the police analyst must maintain a detailed information tracking 
system on street gang members and their associations. Finally, the police 
intelligence system is unable, in most instances, to describe the amorphous 
street gang using organizational charts, map dispositions, and predictive 
courses of action. As in MOOTW, association networks, gang membership 
databases, “turf’ maps, and pattern analysis are the most effective analysis 
tools for describing the American street gang environment. 40 

Police Lessons in Stability, Security, and Surveillance 

There are three implications of these results, dealing with stability, 
security, and surveillance. First, the police system demonstrates the benefits 
of maintaining unit and soldier stability in the constabulary MOOTW 
environment. One of the keys to the police anti-gang units’ successes is 
the fact that the police officers in the gang environment maintain “beats,” 
investigators work the same gangs for years, and analysts focus on specific 
gangs. This “community based policing” approach has the potential to 
enhance intelligence operations in constabulary MOOTW missions. 

The second implication suggests that HUMINT collection teams can, under 
certain conditions, safely perform their collection duties without dedicated 
security forces. In the gang environment, investigators use a graduated 
system of security. In low threat situations, the police HUMINT collector 
relies on on-call reinforcement. If the officer suspects that a mission will 
be more dangerous, reinforcement can be coordinated to be nearby, ready 
to respond within seconds. Finally, in extremely hazardous conditions, an 
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investigator can move into a gang’s territory with multiple security units, 
including heavily armed police analogous to infantrymen. 

The last implication is that selective surveillance can be directed against 
street gangs. In spite of its cost, the smaller police departments each conduct 
surveillance on gang hangouts, parties, and inter-gang meetings. Under certain 
conditions, foreign street gangs should also be placed under surveillance. 
These surveillance operations often result in large amounts of intelligence 
regarding the street gang’s size, structure, alliances, and leadership. 

These three implications illustrate a few of the insights that arise 
from leveraging the expertise of police intelligence against the military 
intelligence paradigm. 

STREET GANGS 

Once street gangs are defined, it becomes clear that those encountered in 
recent MOOTW operations are not so different from those found in many 
American cities. 

Defining Street Gangs 

A “street gang” is defined as a loosely organized group, with a decentralized 
chain of command, claiming control over specific territory, individually or 
collectively engaging in a wide variety of violent criminal activities . 41 

While the territorial nature and violent crime aspects of the definition are 
fairly straightforward, the loose organization and decentralized leadership 
components require clarification. The organizational structure of the street 
gang has two key characteristics: membership and leadership. 

First, street gang members can be divided into two categories: “core 
members” and “fringe members.” Core members are more active in the 
gang’s criminal and social activities. They are also more dependent on the 
gang for their social identity. Fringe members are generally less involved in 
the group, participating intermittently in street gang activities. They tend to 
be more independent and individualistic than core members. 

Second, the street gang leadership is horizontal, usually composed 
of multiple six to eight person age-variegated “cliques” led by a single 
charismatic individual of similar age. Clique leaders rarely take orders from 
other cliques and are motivated by emotion, the desire to make money, build 
the gang’s reputation, and maintain the chaotic, disruptive, status quo. This 
kind of emotionally based, decentralized decision making results in virtually 
non-existent planning cycles and little opportunity for traditional activity 
indicators to develop. 
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The membership and leadership characteristics of the street gang have 
important implications in the comparison between gang police analysis and 
tactical military intelligence analysis. 

Mogadishu, Somalia: 1992-1994 

The threat forces in Somalia were composed of two groups: “military 
and paramilitary forces” and “armed gangs aligned with the factions or 
operating on their own.” These gangs of young male Somalis, called 
mooryacin, were armed by the warlords and paid with women and the drug 
khat to attack the opposing warlords’ forces. According to one firsthand 
account, “rogue gangs” were a priority for HUMINT collection in the early 
phases of the U.S. operation. 42 

The mooryaan clearly behave as street gangs. They have been described 
as “informal gangs” 43 with “no recognizable chain of command.” The clans 
sponsoring the gangs held distinct regions of “turf’ throughout Mogadishu. 
The violent crimes committed by the gangs ranged from “sniping and 
harassment” of UN forces to banditry, looting, and thievery. 44 

Thus, the situation in Mogadishu was analogous to the U.S. street 
gang situation. The U.S. forces were tasked with enforcing the peace, the 
environmental conditions approximated those that produce gangs in U.S. 
urban areas, and the mooryaan gangs meet the definition of street gang. In 
addition to the military efforts directed against the warring clans, the UN’s 
fight in Mogadishu resembled a police action against street gangs. 

Port-au-Prince, Haiti: 1994-1996 

On 19 September 1994, a multi-national force (MNF) sanctioned by the 
United Nations and led by the United States occupied Haiti. The MNF’s 
mission was to restore the legitimately elected government, led by President 
Jean-Bertrand Aristide, to power. By the end of October, 70 percent of 
the Haitian police had deserted their posts, leaving the responsibility 
for maintaining order with the U.S. 10th Mountain Division. After the 
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establishment of the Haitian Interim Public Security Force (IPSF), military 
police and infantrymen continued to walk the streets of Haiti with them. Six 
months later, after accomplishing their mission, the MNF transitioned out of 
Haiti, leaving the operation in the hands of the U.S.-led UN Mission in Haiti 
(UNMIH). UNMIH’s ongoing mission, since October 1994, has included 
helping the Haitian government “maintain security and stability in Haiti.” As 
in Somalia, the American soldiers deployed to Port-au-Prince were serving as 
constables while carrying out their other responsibilities. 45 

U.S. forces deployed to Port-au-Prince were concerned with two threats: 
former paramilitary units and groups of unemployed, criminally active Haitian 
males. The intelligence effort in the capital was evenly divided between these 
two threats. By the 1990s, decades of oppression and exploitation produced 
an environment in Haiti similar to the U.S. gang setting. U.S. military 
intelligence during the deployment recognized at least five rival street gangs 
in the ghettos of Port-au-Prince. The character of the Haitian street gang was 
very similar to the American street gang. Their organization was dynamic and 
hard for the U.S. to track. They ran extremely decentralized operations, with 
no clear leadership. The Haitian street gangs competed against each other 
based on their armaments, fighting skills, ruthlessness, and turf, which was 
delineated with graffiti. Their criminal endeavors included intimidation, drug 
trafficking, theft, and vigilante homicide. 46 

The combination of these factors makes Haiti the strongest candidate 
among the three cases for an operation paralleling the American street gang 
policing experience. The U.S. forces clearly had a constabulary component to 
their mission, the environment approximated the street gang model, and the 
characteristics of the known street gangs match the definition of street gang. 

Bosnia in the U.S. Sector: 1995-present 

Civil War erupted in Bosnia the day after the Europeans and United States 
recognized its independence. In spite of the efforts of the UN Protection 
Force (UNPROFOR) and Operation PROVIDE PROMISE (a humanitarian 
aid airlift), the struggle between Bosnia’s Serbs, Croats, and Muslims still 
displaced more than two million people, killing thousands. Finally, on 16 
December 1995, after the signing of the Bosnian Peace Agreement, the 
NATO-led Implementation Force (IFOR) deployed to Bosnia. One year later, 
in December 1996, IFOR was replaced by a smaller NATO-led force — the 



45 

United Nations Department of Peace Keeping Operations, “Completed Missions,” October 
1998, UN Department of Public Information , URL: <www.un.org/Depts/dpko>, accessed 3 
November 1998; Walter E. Kretchik, “Fielding the International Police Monitors for Operation 
Uphold Democracy,” Low Intensity Conflict & Law Enforcement 7, no. 2 (Autumn 1998): 113- 
118; and Irwin P. Stotzky, Silencing the Guns in Haiti: The Promise of Deliberative Democracy 
(Chicago: University of Chicago Press, 1997): 43. 

Hogan, interview; and Michael W. Schellhammer, “Lessons from Operation Restore 
Democracy,” Military Intelligence , January-March 1996, 20. 



47 



Stabilization Force (SFOR). The SFOR’s primary mission was and continues 
to be deterring hostilities and stabilizing the peace in Bosnia. 

Although the enforcement of law and order in Bosnia is the job of the 
Bosnian national police, the U.S. forces in Bosnia viewed the maintenance 
of “law and order” as a key component to their exit strategy. Accordingly, 
military intelligence soldiers in Bosnia collected information and analyzed 
Bosnia’s criminal problems. 

As in the other two cases, the operation in Bosnia was directed against two 
threats: paramilitary organizations and criminal gangs. Both of these threats 
operated throughout the U.S. sector . 47 

The Bosnian criminal gangs exhibited a cellular, hierarchical structure 
that facilitates the execution of sophisticated organized crimes. The gang 
leadership divided labor within the organization and specified activities to be 
carried out via an effective, directive chain of command. The Bosnian gang 
was territorial, operating in specific areas, occupying public gathering places 
such as bars and cafes. The focus of their criminal activity was profiteering, 
whether from drugs, stolen cars, political interference, or the protection of 
suspected war criminals. Violent crimes were committed, such as drive-by 
shootings and bombings, but they were not common and were generally 
limited to reprisals and intimidation . 48 Given these factors, the Bosnian 
criminal gangs were not street gangs. They were corporate gangs with many 
of the characteristics of organized crime gangs. Based on the environmental 
conditions in Bosnia, street gangs probably exist or will emerge among the 
dislocated and the poor. 49 



INTELLIGENCE FORCE STRUCTURE IN SOMALIA, 
HAITI, AND BOSNIA 

In MOOTW, teaming interrogators with counter-intelligence (Cl) soldiers 
makes sense. Human intelligence soldiers — primarily interrogators — use 
human interactions to determine the situation on the enemy’s side of the 
battlefield. Cl soldiers specializing in HUMINT use human sources to assess 
the threat to U.S. forces on the friendly side of the battlefield. In MOOTW 
where there is no distinguishable forward line of troops, both of these missions 
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can be accomplished by working together, in the same areas, questioning 
the same people . 50 Furthermore, the combined HUMINT team blends the 
vital linguistic skills of the tactical interrogator with the investigative and 
analytical talents of the trained Cl agent . 51 The distinct advantages offered 
by this cooperative arrangement made the Cl/interrogator HUMINT team the 
organization of choice for collection in all three operations. 

In addition to HUMINT teams, the other key personnel in the tactical 
military intelligence system are the “all-source analysts,” the soldiers and 
marines responsible for putting the tactical battlefield picture together for the 
commander on the ground. 

THE INTELLIGENCE LESSONS: TACTICAL 
COLLECTION AND ANALYSIS 

Seven lessons emerged from these three MOOTW operations: 

• Every soldier and Marine in the MOOTW “battlefield” should 
be used as a HUMINT collector. 

• Security is a constant challenge during the collection process. 

• Unconventional sources of information must be developed. 

• Extracting information from the population is time-consuming, 
complicated — and worthwhile. 

• The conventional IPB process should be broadened to include 
factors such as geography, ecology, history, ethnicity, 
religion, and politics. 

• Doctrinal situation tracking tools lack the level of detail 
necessary to portray street gang situations accurately. 

• It is impractical to determine the order of battle, 
organizational structure, and the doctrine of loosely 
organized and led street gangs . 52 

Lesson 1: Everyone Must be a HUMINT Collector 

Each of the three operations under consideration reinforced the critical 
importance of using every available soldier and Marine as a HUMINT 
collector. This philosophy is also advocated by current Army and Marine 
Corps intelligence doctrine. First-hand accounts from Mogadishu indicate that 
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“a massive amount of HUMINT came from foot, motorized and mechanized 
patrols .” 53 Non-combat military units in Somalia were also used as sources 
of HUMINT collection . 54 In Port-au-Prince, people on the streets would 
routinely offer soldiers on patrol information about intimidation attempts, 
illegal weapons caches, and other gang activities . 55 One report noted that 
in Haiti there was “no substitute for the immediate gathering of tactical 
information by soldiers on the ground .” 56 In Bosnia, dismounted patrols were 
“critical intelligence collectors” at the Brigade level . 57 

The successful employment of non-intelligence soldiers as HUMINT 
collectors depends on the soldier’s knowing what information is needed 
before the patrol and a mechanism for reporting that information to the 
intelligence analyst during or after the patrol. During the IFOR mission in 
Bosnia, the effectiveness of non-intelligence soldier patrols was hindered by 
a critical shortage of trained intelligence debriefers. 58 Early in the mission, 
IFOR’s efforts were also stymied by an inadequate system of archiving 
security patrol debriefings. In the face of the large volume of information 
being gathered, a great deal of useful information for future pattern analysis 
was “lost in the paper shuffle .” 59 

Lesson 2: The Challenge of Security During Collection 

The second intelligence problem focuses on the precarious balance 
between keeping HUMINT teams safe in the foreign urban environment and 
the necessity for them to mingle discreetly with the population to do their job. 
HUMINT teams normally conduct their collection in uniform, travel in soft- 
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skinned military vehicles, and carry only light sidearms . 60 From the beginning 
in Somalia, HUMINT teams “often took direct action in seizing targets upon 
discovering them,” including illegal weapons and ammunition caches . 61 
The need for HUMINT teams to conduct these constabulary operations was 
also noted in Haiti . 62 Unfortunately, in Somalia and Bosnia, the perceived 
threat against U.S. forces became so great that “as force protection became 
paramount counterintelligence teams [were] restricted to the compounds .” 63 
In some instances in Somalia, informants were forced to meet with the 
HUMINT teams in a secure U.S. compound . 64 

One solution to this problem evolved in Bosnia, where HUMINT teams 
were permitted to travel in two-vehicle convoys rather than four-vehicle 
convoys during daylight hours. These modified security convoys 65 escorted 
the team to a village or city and then remained as “overwatch” security in the 
local area , 66 allowing the HUMINT teams to more discreetly conduct their 
mission among the population . 67 This type of security arrangement is very 
closely paralleled by the domestic law enforcement community and will be 
discussed further below. 

Lesson 3: The Importance of “Non-Standard” Sources 

HUMINT collection operations in Haiti and Bosnia also highlighted 
the importance of “seeking information creatively ” 68 by exploiting every 
human-based information source in the MOOTW environment. The Somali 
culture is orally based . 69 As a result, newspapers, posters, and graffiti have 
little relevance and HUMINT collectors had very few non-standard sources 
available to them. 

In Haiti, gang graffiti was used to determine street gang territorial 
boundaries . 70 During IFOR, English translations of Bosnian media (including 
newspapers, television, and radio) were circulated throughout the command 
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on a daily basis. 7 1 As stability returned to the Bosnian communities, HUMINT 
teams began to exploit locally produced posters and flyers, newspapers, and 
church bulletins in an effort to develop a more acute sense of situational 
awareness. 72 Any non-military reporters or aid workers visiting Brigade 
tactical operations centers in Bosnia were also debriefed regarding the 
situation out in the countryside. 73 

Lesson 4: Extracting HUMINT is Slow and Complex 

The final lesson derived from the HUMINT collection experience reflects 
the immense difficulty inherent in basic HUMINT operations — both low- 
level source operations (informant networks) and surveillance operations. 
According to one first-hand account from Somalia, “the establishment of 
low-level HUMINT sources is a long and often complicated process.” 74 
Developing effective informant networks can take weeks or even months, 
requiring a significant investment in translation resources and Cl agent 
stability. 75 In Somalia, U.S. “soldiers could not communicate effectively [with 
the Somalis], nor did they understand Somali customs and traditions.” 76 As a 
result, Somali interpreters were in high demand, including military linguists, 
contracted U.S. civilians, and local Somalis — who were often mistrusted 
because of perceived factional and tribal loyalties. 77 

Once the language barrier was overcome, source operations required that 
the HUMINT teams remain in one area long enough to build trustworthy 
contacts. 78 From the Army perspective, it took HUMINT teams three weeks 
to produce their first Cl report. 79 Marine HUMINT teams in Somalia adopted 
a “cop-on-the-beat” approach to source operations that was reported to be 50- 
60 percent accurate. 80 In each of the cases, the creation of source networks is 
based on the individual Cl officer’s personality and interpersonal skills. 81 

Once established, Somali sources had to be handled carefully to protect 
their identity. If discovered, “suspected informants among Aideed’s faction 
were assassinated . . . those recruited from rival clans dared not enter south 
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Mogadishu for fear of suffering a similar fate .” 82 HUMINT teams in Bosnia 
used the civil telephone system to receive tips as a measure to protect an 
informant’s confidentiality . 83 Overcoming language differences, extensive 
time and resource commitments, and source protection measures make 
low-level source operations expensive endeavors. But as the only source 
of detailed information on the morale, attitude, and intentions of the host 
nation’s community — including street gangs — they were worth the effort. 

Human surveillance (observing individuals) was not widespread in 
Somalia, Haiti, and Bosnia. In Haiti, surveillance against street gangs was 
conducted intermittently on key sites such as houses, businesses, or street 
corners, but U.S. forces did not have the manpower for around-the-clock 
operations . 84 Likewise, in Bosnia, some surveillance was conducted for 
short periods, usually around key leader meetings, to observe associations, 
take photos, and secure the meeting site . 85 While surveillance operations 
proved effective, the manpower requirements for extended operations 
were prohibitive. 

Lesson 5: Understanding the “Cultural Environment” 

The final three intelligence lessons were derived from the analysis efforts 
of the tactical-level intelligence staffs. The requirement to increase the scope 
of IPB in MOOTW, which has been noted in Army intelligence doctrine, 
was reaffirmed by observations from Mogadishu and Port-au-Prince. In 
Somalia, intelligence analysts had to apply a “much broader scope than that 
found under the more traditional focus” including “political/military affairs, 
ethnic conflict, non-governmental organizations, UN operations and police 
operations .” 86 In Haiti, soldiers on the ground observed that IPB in the urban 
MOOTW environment is “vastly different from IPB in conventional warfare” 
and must include the population’s social class, economic distributions, 
locations of key facilities — such as schools, churches, and businesses — and 
known black market areas . 87 

In Haiti, to facilitate this broad analytical perspective, tactical analysts 
were required to “travel out into the operational environment” to get a “feel 
for the people, activity, and potential problems” in the community. This 
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approach was also used in Somalia, to a more limited extent. 88 This first-hand, 
infantryman’s view of the situation helped tactical analysts understand the 
impact of the unique “social, economic, political, and cultural geography” 89 
in the street gang environment. 

Lesson 6: Tracking the Gang Situation Demands Precise Detail 

In addition to the requirement to broaden the scope of the intelligence 
analyst, the MOOTW environment simultaneously demands a much 
finer resolution in situational tracking. In Haiti, analysts observed that 
diverse incidents such as demonstrations, enemy collection efforts, 
intimidation attempts, and criminal activities — including murders, 
arsons, beatings, and looting — were relevant to the situation and had to 
be tracked and analyzed. 90 

The commander’s need for high-resolution situational tracking in MOOTW 
demonstrated the ineffectiveness of conventional map symbols. One tactical 
intelligence officer lamented that “the process used to graphically capture and 
communicate intelligence in OOTW is not standardized.” 91 During Operation 
Uphold Democracy, forces in Haiti developed their own internal map 
symbols, which were “used to portray incidents such as civil disturbances, 
humanitarian assistance organizations, targeted individual civilian cars,” and 
arms caches. 92 This demand for resolution in Mogadishu and Port-au-Prince 
also demonstrated that standard military “1:50,000 scale maps were almost 
useless in the city.” 93 
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Lesson 7: The Impracticality of Conventional Description 
Methods 

This intelligence lesson observes that most irregular forces — including 
street gangs — cannot be clearly described using conventional intelligence 
methods. According to Jeffrey White, who wrote as Chief of the Middle East/ 
Africa Regional Military Assessment Branch of the Defense Intelligence 
Agency, “Shifting patterns of family, tribal, religious, economic, and military 
relations [in OOTW] produce a complex, dynamic, and uncertain analytic 
environment. Irregular forces do not have highly articulated doctrine. This 
makes it difficult to display confidently what the enemy’s forces look like 
and how they are deployed.” 94 This frustrating effect was confirmed by 
observations in all three operations in this study. In Somalia, an attempt was 
made early in the mission to “apply the same techniques used to display Iraqi 
order of battle” to the Somali factions and gangs. It proved ineffective. 

One Marine Corps observer noted that Somalia’s street gangs were hard 
to track and “build intelligence” on. 95 In Haiti, street gangs also showed 
no doctrine or pattern of activity, making predictive analysis “extremely 
difficult.” 96 U.S. analysts in Haiti developed “turf maps” of the gang areas in 
the ghettos, but were unable to produce useable organizational charts. 97 The 
dynamic nature of the threat in MOOTW consistently limited the ability of 
analysts to describe the enemy. In all three cases, acquaintance and association 
networks, general predictive assessments, and vaguely defined areas of “turf ’ 
had to suffice in place of more “doctrinal” organizational charts, enemy 
courses of action, and six-digit map coordinate force dispositions. 

TACTICAL INTELLIGENCE FROM AMERICA’S 
STREETS 

A police anti-gang unit in the U.S. deals with the same intelligence issues 
faced by the MOOTW forces. Understanding the domestic police approach 
to each of the seven intelligence lessons discussed above provides additional 
insights for the military’s tactical intelligence operations. 

Evolution of Police Intelligence 

The need to protect the community from the disruptive influence of foreign 
agents, domestic terrorists, and organized crime in the first half of the 20th 
century spurred the development of the first police intelligence units. 98 The 
civic disruptions of the 1960s motivated the use of these organized crime 
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intelligence techniques against loosely organized urban groups such as the 
street gang." 

These centralized intelligence-gathering units are composed of a range of 
different police personnel, using a combination of military-style and police 
rank. In the police community, “lieutenants” and “sergeants” manage and 
administer units. They are normally senior officers with 10 to 20 years of 
police experience. The “detectives” or “investigators” (depending on the 
police department) gather information, question witnesses and suspects, run 
informant networks, conduct surveillance operations, and solve criminal 
cases. They are comparable to HUMINT collectors such as counterintelligence 
agents and tactical interrogators (see Figure 2). Police anti-gang analysts 
maintain databases, review department arrest reports for gang connections, 
compile statistics, and assist detectives with pattern analysis. 

Unlike the military system, the primary responsibility for developing 
“situational awareness” in the anti-gang intelligence unit lies with the 
investigator, not the analyst. Accordingly, the assessment of the police 
analytical process will rely on the experiences of the gang investigator as 
well as those of the crime analyst. The next section describes the sources and 
methodologies used to summarize police anti-gang intelligence. 



" Both Chicago and Los Angeles trace the origins of their anti-gang intelligence efforts to 
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regular Army) to quell. Police Lieutenant Drake Robles, Operation Safe Streets Bureau, Los 
Angeles County Sheriff’s Department, interview by author, 1 June 1999; and Police Sergeant 
Steven Caluris, Supervisor of the Gang Analytic Program (GAP), Chicago Police Department, 
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Figure 2. Comparing Intelligence Structures 

Source: Author. 

Comparing intelligence philosophies and missions at the philosophical 
level, both the police and military leadership strive to achieve similar uses 
for intelligence. This parallel may come from the fact that, in spite of their 
independent origins, the two intelligence systems have shared membership 
based on the military’s Reserve and National Guard systems. Both schools of 
thought also recognize the primacy of information in the operational planning 
process. The common military adage “intelligence drives maneuver” is 
comparable to the police philosophy that “obtaining adequate intelligence 
data on a gang is a prerequisite to any enforcement action. ” 100 Regardless of 
whether your uniform is blue or camouflage, the following observation rings 
true: “As the world becomes increasingly complex, police administrators 
and planners are finding it more and more necessary to collate seemingly 
unrelated bits of information into some kind of understandable whole .” 101 

Police Approaches to Intelligence Problems 

Beyond the philosophical similarities between police and military 
intelligence, gang police have developed many of the same approaches to the 
collection and analysis problems inherent in the street gang environment. 

Lesson 1: Everyone Must be a HUMINT Collector 

As the soldiers and Marines learned in Mogadishu, Port-au-Prince, and 
Bosnia, gang police know that “highly useful street-level intelligence can 
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be generated by aggressive and alert patrol officers .” 102 In Chicago, most 
of the raw data used by the Gang Analytic Program comes from the beat 
police and investigators in daily contact with gangs on the streets . 103 In 
Los Angeles County, one sergeant observed that the most accurate picture 
of what is going on with the gangs comes from gang investigators and the 
observations of ordinary patrol deputies . 104 The patrolmen in Norfolk “know 
what’s going on” with the gangs and routinely exchange information with the 
gang squad . 105 These findings indicate strong parallels between the police 
and military intelligence systems. 

In Dallas, most information regarding the gang situation comes from 
the gang unit itself — from the enforcement officers and detectives . 106 There 
appear to be two reasons why the Dallas police do not contribute as much 
gang information as other city’s police do. First, Dallas is the only department 
observed that has not fully implemented the “community based policing” 
philosophy. Under this approach, police officers spend the majority of their 
time in one particular neighborhood. Instead, the Dallas police respond 
wherever they are needed throughout the city based on citizens’ calls. 
According to one Dallas gang detective, stabilizing police and assigning 
neighborhood responsibility would facilitate better information flow from 
the patrol officers . 107 Second, Dallas uses a sizeable complement of special 
gang enforcement officers. One theory is that the existence of these “gang 
enforcement officers” frees ordinary police to focus on other priorities leaving 
the gang specialists to handle the street gang problem . 108 The impact of patrol 
officer stability and specialized enforcement on information gathering has 
definite implications for the military and will be addressed below. 
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Richard Kieffer-Adrian, “Street Level Intelligence Gathering,” Law and Order , May 
1995,31. 

^ Caluris, interview. 
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Police Sergeant Steven Newman, Operation Safe Streets Bureau, Los Angeles County 
Sheriff’s Department, interview by author, 1 June 1999. 

^ Randy Crank, Gang Investigator, Norfolk Police Department, Gang Squad, interview by 
author, 20 June 1999. 

^ Detective Sam Schiller, Gang Unit, Dallas Police Department, interview by author, 3 

June 1999. 

107 

When stabilized, police get to know the kids as people and take the time to talk to them 
when they do not need information from them or want to “bust” them. Schiller, interview. 

^ Caluris, interview. 
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Figure 3. Overt Interview, Dallas 

Source: “Dallas Police Gang Handbook,” 
unpublished handbook produced by the 
Dallas Police Department Youth and 
Family Violence Division Gang Unit, 

February 1995, cover. 

Another lesson learned from the military was that soldiers need to know 
the intelligence requirements and have a method of reporting what they have 
observed. One of the vexing intelligence problems noted in Bosnia was that 
debriefing each combat patrol with trained intelligence personnel was costly 
in terms of manpower and generated more information than the intelligence 
section could effectively catalog and analyze. The anti-gang police have 
approached this problem from a different perspective. 
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